WebKit - 'WebCore::Node::getFlag' Use-After-Free

-webkit-flow-into: textarea; function freememory var a; forvar i=0;i foo !-- ================================================================= ASan log: ================================================================= ==29717==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000053b3...