diff --git a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
index 27788e7..1650143 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
@@ -220,24 +220,24 @@
                 jit.or32(GPRInfo::regT2, MacroAssembler::AbsoluteAddress(arrayProfile->addressOfArrayModes()));
             }
         }
-        
+
         if (!!exit.m_valueProfile)
             jit.store64(GPRInfo::regT0, exit.m_valueProfile.getSpecFailBucket(0));
     }
-    
-    // Materialize all objects. Don't materialize an object until all of the objects it needs
-    // have been materialized. Curiously, this is the only place that we have an algorithm that prevents
-    // OSR exit from handling cyclic object materializations. Of course, object allocation sinking
-    // currently wouldn't recognize a cycle as being sinkable - but if it did then the only thing that
-    // would ahve to change is this fixpoint. Instead we would allocate the objects first and populate
-    // them with data later.
+
+    // Materialize all objects. Don't materialize an object until all
+    // of the objects it needs have been materialized. We break cycles
+    // by populating objects late - we only consider an object as
+    // needing another object if the later is needed for the
+    // allocation of the former.
+
     HashSet<ExitTimeObjectMaterialization*> toMaterialize;
     for (ExitTimeObjectMaterialization* materialization : exit.m_materializations)
         toMaterialize.add(materialization);
-    
+
     while (!toMaterialize.isEmpty()) {
         unsigned previousToMaterializeSize = toMaterialize.size();
-        
+
         Vector<ExitTimeObjectMaterialization*> worklist;
         worklist.appendRange(toMaterialize.begin(), toMaterialize.end());
         for (ExitTimeObjectMaterialization* materialization : worklist) {
@@ -246,20 +246,28 @@
             for (ExitPropertyValue value : materialization->properties()) {
                 if (!value.value().isObjectMaterialization())
                     continue;
+                if (!value.location().neededForMaterialization())
+                    continue;
                 if (toMaterialize.contains(value.value().objectMaterialization())) {
-                    // Gotta skip this one, since one of its fields points to a materialization
-                    // that hasn't been materialized.
+                    // Gotta skip this one, since it needs a
+                    // materialization that hasn't been materialized.
                     allGood = false;
                     break;
                 }
             }
             if (!allGood)
                 continue;
-            
-            // All systems go for materializing the object. First we recover the values of all of
-            // its fields and then we call a function to actually allocate the beast.
+
+            // All systems go for materializing the object. First we
+            // recover the values of all of its fields and then we
+            // call a function to actually allocate the beast.
+            // We only recover the fields that are needed for the allocation.
             for (unsigned propertyIndex = materialization->properties().size(); propertyIndex--;) {
-                const ExitValue& value = materialization->properties()[propertyIndex].value();
+                const ExitPropertyValue& property = materialization->properties()[propertyIndex];
+                const ExitValue& value = property.value();
+                if (!property.location().neededForMaterialization())
+                    continue;
+
                 compileRecovery(
                     jit, value, record, jitCode->stackmaps, registerScratch,
                     materializationToPointer);
@@ -273,7 +281,7 @@
             jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(operationMaterializeObjectInOSR)), GPRInfo::nonArgGPR0);
             jit.call(GPRInfo::nonArgGPR0);
             jit.storePtr(GPRInfo::returnValueGPR, materializationToPointer.get(materialization));
-            
+
             // Let everyone know that we're done.
             toMaterialize.remove(materialization);
         }
@@ -284,6 +292,27 @@
         RELEASE_ASSERT(toMaterialize.size() < previousToMaterializeSize);
     }
 
+    // Now that all the objects have been allocated, we populate them
+    // with the correct values. This time we can recover all the
+    // fields, including those that are only needed for the allocation.
+    for (ExitTimeObjectMaterialization* materialization : exit.m_materializations) {
+        for (unsigned propertyIndex = materialization->properties().size(); propertyIndex--;) {
+            const ExitValue& value = materialization->properties()[propertyIndex].value();
+            compileRecovery(
+                jit, value, record, jitCode->stackmaps, registerScratch,
+                materializationToPointer);
+            jit.storePtr(GPRInfo::regT0, materializationArguments + propertyIndex);
+        }
+
+        // This call assumes that we don't pass arguments on the stack
+        jit.setupArgumentsWithExecState(
+            CCallHelpers::TrustedImmPtr(materialization),
+            CCallHelpers::TrustedImmPtr(materializationToPointer.get(materialization)),
+            CCallHelpers::TrustedImmPtr(materializationArguments));
+        jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(operationPopulateObjectInOSR)), GPRInfo::nonArgGPR0);
+        jit.call(GPRInfo::nonArgGPR0);
+    }
+
     // Save all state from wherever the exit data tells us it was, into the appropriate place in
     // the scratch buffer. This also does the reboxing.