See attachment 144983 [details] on bug 87925 for a repro. It appears attribute nodes are being garbage collected too aggressively.
*** Bug 88062 has been marked as a duplicate of this bug. ***
*** Bug 131881 has been marked as a duplicate of this bug. ***
*** Bug 127480 has been marked as a duplicate of this bug. ***
Consolidated test expectations in <http://trac.webkit.org/r167583>. The test for this is fast/dom/gc-attribute-node.html, and it's not a very good test, because it sometimes starts to pass because of memory layout changes. I expect that running the second half of the test asynchronously would make it more reliable, as garbage collection would be more likely to work better.