mccr8 was looking at this once. The idea is to use the hazard analysis framework to check for cases where we're iterating over a list of nodes and doing something that could mutate that list.

We need more details about this in order to be able to understand it.

Hm, I think the MOZ_CAN_RUN_SCRIPT analysis may have replaced the need for this analysis, if I'm understanding it correctly. Specifically, I think that right now if you are iterating over DOM nodes and calling anything marked MOZ_CAN_RUN_SCRIPT, then you are required (via static analysis) to hold onto a reference to them.

mccr8, is that correct? Is there still a use for an additional analysis here?

I don't think MOZ_CAN_RUN_SCRIPT understands iterator invalidation. An individual DOM node can be rooted, but the question is whether the array we're iterating over is resized.

I don't think I had any more than a vague idea for how to do this, so feel free to close it.