NamedNodeMap already keeps its Element owner alive, so we can dump the FIXME and custom visitChildren() in the JSC wrapper.
Created attachment 188728 [details] Patch
Comment on attachment 188728 [details] Patch I believe this is no longer needed. But do we have tests that cover it?
(In reply to comment #0) > NamedNodeMap already keeps its Element owner alive, so we can dump the FIXME and custom visitChildren() in the JSC wrapper. Has this always been true, or is it a recent change? I'm pretty sure I originally learned about the need for this function the hard way.
(In reply to comment #3) > (In reply to comment #0) > > NamedNodeMap already keeps its Element owner alive, so we can dump the FIXME and custom visitChildren() in the JSC wrapper. > > Has this always been true, or is it a recent change? > > I'm pretty sure I originally learned about the need for this function the hard way. I changed it with https://trac.webkit.org/changeset/104130
(In reply to comment #2) > (From update of attachment 188728 [details]) > I believe this is no longer needed. But do we have tests that cover it? Yup! You added fast/dom/Attr/access-after-element-destruction.html for this issue here: http://trac.webkit.org/changeset/48769 That one also covers Attr node wrappers which are slightly less trivial to fix, but might be worth doing next.
Committed r143118: <http://trac.webkit.org/changeset/143118>