Examples of this issue are in VisualStyleDetailsPanel:158 and VisualStylePropertyEditor.js:68.
<rdar://problem/23211505>
Created attachment 263766 [details] Patch
I don't think I missed any problematic usages, but I was searching using a regex so it's possible I missed one. This is the regex I used: \.classList\.toggle\([^,\n]+,[^\)\n]+\)
Comment on attachment 263766 [details] Patch Clearing flags on attachment: 263766 Committed r191417: <http://trac.webkit.org/changeset/191417>
All reviewed patches have been landed. Closing bug.