V8DOMWrapper::wrapNativeNodeFilter() returns NULL if the argument is not a function. At the same time, Traversal::acceptNode() accepts all NULL filters. So if we pass in a filter that's not a function, we end up accepting it, instead of throwing an exception.
After http://trac.webkit.org/changeset/65853 the expectation is that only functions and objects with an acceptNode() method should be accepted. Everything else should be rejected. So we should change V8DOMWrapper::wrapNativeNodeFilter() to always create a filter, and update V8NodeFilterCondition::acceptNode() to check for these conditions, like JSNodeFilterCondition::acceptNode() does.
Created attachment 65308 [details]
Comment on attachment 65308 [details]