The allocation sinking optimization pass creates PhantomNewObject nodes to keep track of the old NewObject nodes, which must be kept as they are used to restore the state of allocations on OSR exit, and thus should be marked NodeMustGenerate.
They are currently prevented from being removed by the PutHint for the object's structure, but that is a rather implicit safety net.
Created attachment 251208 [details]
Comment on attachment 251208 [details]
Clearing flags on attachment: 251208
Committed r183040: <http://trac.webkit.org/changeset/183040>
All reviewed patches have been landed. Closing bug.
convertToPhantomNewObject() do not properly set the NodeMustGenerate flag.
Created attachment 251262 [details]
Comment on attachment 251262 [details]
Clearing flags on attachment: 251262
Committed r183078: <http://trac.webkit.org/changeset/183078>