When defining a function for for example namespace resolving it's handy to store this on the XML document Object. But webkit loses the function sometimes for strange reasons. See testcase, it should just continue counting and counting, this does work in Firefox and Opera
Created attachment 17701 [details] Testcase
Confirmed with r28024. This can be reproduced reliably by forcing garbage collection.
Created attachment 17718 [details] reduced test case
Not a regression from Safari 2.
It also looses the 'documentElement' property
<rdar://problem/5633005>
*** Bug 17076 has been marked as a duplicate of this bug. ***
Acid3 itself has a larger and more advanced test case that will need to be verified when fixing this.
This example does: - get a dom object (domObjectA) - get a dom object reachable from that dom object, using dom methods (domObjectB) - set custom data on domObjectB - store domObjectA in a local variable - force a GC - access domObjectB through the dom methods off of domObjectA - notice that domObjectB is a fresh binding object, thus has no custom data When marking, we don't follow builtin dom methods and mark the related binding objects. One fix would be to mark all DOM objects held in the DOM cache which have custom data set on them. We would need some way to purge the DOM cache when the page it torn down (but we might do that already). I wonder how we keep custom prototypes alive... maybe we walk the prototype chain of any object when marking.
This issue isn't quite the same as Acid3 tests 26 and 27, but I have a fix that addresses both. (Acid3 doesn't rely on custom properties on the node).
Created attachment 19543 [details] patch v1
Comment on attachment 19543 [details] patch v1 r=me. Though you could use some braces for outer if-statements as is now our style. 90!!!
Landed in r30790. <http://trac.webkit.org/changeset/30790>