var doc = document.implementation.createHTMLDocument('a'); Node's can cache nodelists in m_nodeLists. They keep a counter on their document, via document()->addNodeListCache and document()->removeNodeListCache. However, when a node is adopted between documents, nothing is done to keep this balance. On adoption, we should be clearing m_nodeLists and calling document()->removeNodeListCache. var b = document.createElement('b'); // Give it a node list cache on document b.childNodes; // Attach it to doc to update m_document doc.adoptNode(b); doc.body.appendChild(b); doc.body.removeChild(b); // GC here if you can, or reload the page to fire ~Node and cleanup m_nodeLists
Created attachment 21670 [details] test case (will assert)
Confirmed with r34513.
Are there any symptoms in release builds?
<rdar://problem/7431572>
I see no reason to clear m_nodeLists.
Created attachment 45410 [details] patch
style-queue ran check-webkit-style on attachment 45410 [details] without any errors.
Comment on attachment 45410 [details] patch > \ No newline at end of file r=me
http://trac.webkit.org/changeset/52511