| Summary: | Static NodeList needs to to keep item wrappers alive | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Erik Arvidsson <arv> | ||||
| Component: | DOM | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | NEW --- | ||||||
| Severity: | Normal | CC: | ap, ggaren, haraken, rniwa, sam, webkit.review.bot | ||||
| Priority: | P2 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
Does this problem only apply to StaticNodeList? What about StaticHashSetNodeList and DynamicNodeList? In JSC, the way to fix this is to make the node list wrapper's visit function add its document to the opaque root set. This will require giving all NodeLists, and not just DynamicNodeLists, owner document pointers. (In reply to comment #1) > Does this problem only apply to StaticNodeList? What about StaticHashSetNodeList and DynamicNodeList? Most (all?) of the DynamicNodeLists keep the wrappers alive though other means. For example the nodes in a childNodes NodeList are kept alive as long as the parent node is kept alive. How do they keep the parent node alive? (In reply to comment #3) > How do they keep the parent node alive? DynamicNodeList has a RefPtr to its owner. But what keeps the JavaScript wrapper alive? *** Bug 105666 has been marked as a duplicate of this bug. *** |
Created attachment 151772 [details] Layout test Currently we do not keep the wrappers of static node lists alive. Both the JSC and V8 bindings get this wrong. document.body.innerHTML = '<b></b>'; var elements = document.body.querySelectorAll('*'); elements[0].customProperty = 42; document.body.textContent = ''; gc(); shouldBe('elements[0].customProperty', '42');