WebCore has provided API to modify DOM tree.
There are V8 bindings which allows invocation of WebCore API from JavaScript.
Have a look at: chromium/src/out/Release/obj/gen/webcore/bindings/V8Document.cpp
This is auto generated from IDL file. all Getter/Setters are JS
attribute getter/setters and callbacks are JS methods e.g.
document.getElementById method is mapped to getElementByIdCallback,
which will eventually go to Document::getElementById.
Hope this helps.
best,
anish