[Webkit-unassigned] [Bug 144227] New: Unexpected custom DOM wrapper property is undefined soon after it was assigned

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=144227

            Bug ID: 144227
           Summary: Unexpected custom DOM wrapper property is undefined
                    soon after it was assigned
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: timothy at apple.com
                CC: fpizlo at apple.com, ggaren at apple.com,
                    joepeck at webkit.org, mark.lam at apple.com,
                    msaboff at apple.com, webkit-bug-importer at group.apple.com

TimelineRuler.js in the Web Inspector occasionally throws an exception and never records. The _labelElement property we add to a DOM node at the beginning of a loop body ends up being undefined at the end of the loop body. This smells like a JIT optimization bug to me since this code has always worked fine and only recently started happening. It is also very inconsistent on when it happens. Because it is so random when it happens, we haven't been able to pin point steps or make a reduction. Just resting the Inspector window, or zooming the Timeline in and out causes updateLayout to be called.