Some markChildren methods are calling getCachedDOMNodeWrapper, which will find the wrapper for the current world only. This means that wrappers may be GC'ed prematurely, and properties lost. Move to a model more like markDOMObjectWrapper, mark wrappers for all worlds.
Created attachment 43014 [details] The patch
Sending WebCore/ChangeLog Sending WebCore/bindings/js/JSAttrCustom.cpp Sending WebCore/bindings/js/JSDOMBinding.cpp Sending WebCore/bindings/js/JSDOMBinding.h Sending WebCore/bindings/js/JSNamedNodeMapCustom.cpp Sending WebCore/bindings/js/JSNodeCustom.cpp Sending WebCore/bindings/js/JSSVGElementInstanceCustom.cpp Sending WebCore/bindings/js/JSStyleSheetCustom.cpp Transmitting file data ........ Committed revision 50850.