Tracing from JavaScript to the DOM and Back Again
v8project.blogspot.com
v8project.blogspot.com
I had to work around the DOM limitations of V8 heap snapshots by building a JavaScript 'mirror' of DOM state that I could examine in the snapshots [1]. Perhaps I'll be able to strip out that logic and rely on the improved snapshots!
[0] http://plasma-umass.org/BLeak/
[1] Discussed in Section 5.3.2 of the preprint of our PLDI 2018 paper: https://github.com/plasma-umass/BLeak/raw/master/paper.pdf
Nice