Created attachment 144983 [details] Repro. Must run Chrome with --js-flags=--expose_gc. Object grouping for attribute nodes is incorrect. See the attached repro. It should print "magic", "magic" but because the attribute node wrapper is collected prematurely, it prints "magic", "undefined".
Created attachment 145208 [details] Patch
Comment on attachment 145208 [details] Patch Filed bug 88045 for JSC. It seems the same bug exists in JSC bindings.
Comment on attachment 145208 [details] Patch LGTM. You might want to run this patch by haraken before landing.
Comment on attachment 145208 [details] Patch LGTM from me too
Comment on attachment 145208 [details] Patch Clearing flags on attachment: 145208 Committed r119196: <http://trac.webkit.org/changeset/119196>
All reviewed patches have been landed. Closing bug.
A newly added test (fast/dom/gc-attribute-node.html) fails on Qt, GTK and EFL 64 bit since r119196. I will skip this test until the problem is solved. https://bugs.webkit.org/show_bug.cgi?id=88062