| Summary: | [V8] Expando properties on attribute nodes disappear | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Dominic Cooney <dominicc> | ||||||
| Component: | DOM | Assignee: | Dominic Cooney <dominicc> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | abarth, dominicc, haraken, japhet, jbadics, webkit.review.bot | ||||||
| Priority: | P2 | ||||||||
| Version: | 528+ (Nightly build) | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Bug Depends on: | 88045, 88062 | ||||||||
| Bug Blocks: | |||||||||
| Attachments: |
|
||||||||
Created attachment 145208 [details]
Patch
Comment on attachment 145208 [details] Patch Filed bug 88045 for JSC. It seems the same bug exists in JSC bindings. Comment on attachment 145208 [details]
Patch
LGTM. You might want to run this patch by haraken before landing.
Comment on attachment 145208 [details]
Patch
LGTM from me too
Comment on attachment 145208 [details] Patch Clearing flags on attachment: 145208 Committed r119196: <http://trac.webkit.org/changeset/119196> All reviewed patches have been landed. Closing bug. A newly added test (fast/dom/gc-attribute-node.html) fails on Qt, GTK and EFL 64 bit since r119196. I will skip this test until the problem is solved. https://bugs.webkit.org/show_bug.cgi?id=88062 |
Created attachment 144983 [details] Repro. Must run Chrome with --js-flags=--expose_gc. Object grouping for attribute nodes is incorrect. See the attached repro. It should print "magic", "magic" but because the attribute node wrapper is collected prematurely, it prints "magic", "undefined".