It assumes that a child will always be transformed before it does by assuming it will already be a phantom allocation. This probably happens to be true because of how we generate byte code for arguments allocation and how traversal of the graph works using blocksInNaturalOrder. However, there is no guarantee that blocksInNaturalOrder must first traverse a block's dominator before the block being dominated.
<rdar://problem/29032041>
Created attachment 293464 [details] patch
Comment on attachment 293464 [details] patch r=me.
Comment on attachment 293464 [details] patch Clearing flags on attachment: 293464 Committed r208185: <http://trac.webkit.org/changeset/208185>
All reviewed patches have been landed. Closing bug.