[turbofan] fix another divergence in escape analysis

This divergence bug is very similar to the one fixed in https://codereview.chromium.org/2522253002/, this time it is an oscillation between a cleared field and a new phi node. The page http://www.sears.com/clothing-shoes-jewelry-clothing-men-s-clothing-men-s-jeans/b-1325287370?Brand=LEE&filterList=Brand&sortOption=UNITS_HIGH_TO_LOW allows for a reliable reproduction.

This fix makes sure that once a field that generated a phi gets cleared, it always stays cleared.

BUG=chromium:670202

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2599793002
Cr-Commit-Position: refs/heads/master@{#41922}

src/compiler/escape-analysis.cc

@@ -168,7 +168,7 @@ class VirtualObject : public ZoneObject {
 
   void SetField(size_t offset, Node* node, bool created_phi = false) {
     fields_[offset] = node;
-    phi_[offset] = created_phi;
+    phi_[offset] = phi_[offset] || created_phi;
   }
   bool IsTracked() const { return status_ & kTracked; }
   bool IsInitialized() const { return status_ & kInitialized; }
@@ -485,7 +485,8 @@ bool VirtualObject::MergeFrom(MergeCache* cache, Node* at, Graph* graph,
       size_t arity = at->opcode() == IrOpcode::kEffectPhi
                          ? at->op()->EffectInputCount()
                          : at->op()->ValueInputCount();
-      if (cache->fields().size() == arity) {
+      if (cache->fields().size() == arity &&
+          (GetField(i) || !IsCreatedPhi(i))) {
         changed = MergeFields(i, at, cache, graph, common) || changed;
       } else {
         if (GetField(i) != nullptr) {