Bug 91014

Summary: Static NodeList needs to to keep item wrappers alive
Product: WebKit Reporter: Erik Arvidsson <arv>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: NEW    
Severity: Normal CC: ap, ggaren, haraken, rniwa, sam, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Layout test none

Erik Arvidsson
Reported 2012-07-11 14:12:22 PDT
Created attachment 151772 [details] Layout test Currently we do not keep the wrappers of static node lists alive. Both the JSC and V8 bindings get this wrong. document.body.innerHTML = '<b></b>'; var elements = document.body.querySelectorAll('*'); elements[0].customProperty = 42; document.body.textContent = ''; gc(); shouldBe('elements[0].customProperty', '42');
Attachments
Layout test (374 bytes, text/html)
2012-07-11 14:12 PDT, Erik Arvidsson 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Geoffrey Garen
Comment 1 2012-07-16 11:50:30 PDT
Does this problem only apply to StaticNodeList? What about StaticHashSetNodeList and DynamicNodeList? In JSC, the way to fix this is to make the node list wrapper's visit function add its document to the opaque root set. This will require giving all NodeLists, and not just DynamicNodeLists, owner document pointers.
Erik Arvidsson
Comment 2 2012-07-16 14:29:37 PDT
(In reply to comment #1) > Does this problem only apply to StaticNodeList? What about StaticHashSetNodeList and DynamicNodeList? Most (all?) of the DynamicNodeLists keep the wrappers alive though other means. For example the nodes in a childNodes NodeList are kept alive as long as the parent node is kept alive.
Geoffrey Garen
Comment 3 2012-07-16 14:33:55 PDT
How do they keep the parent node alive?
Ryosuke Niwa
Comment 4 2012-07-16 14:35:02 PDT
(In reply to comment #3) > How do they keep the parent node alive? DynamicNodeList has a RefPtr to its owner.
Geoffrey Garen
Comment 5 2012-07-16 14:46:37 PDT
But what keeps the JavaScript wrapper alive?
Adam Klein
Comment 6 2013-03-19 13:23:44 PDT
*** Bug 105666 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.