A tracking bug which comes from Bug 107640. In some case, Node::attached() is true even the node is deleted. We should be able to put ASSERT(!attached()) in ContainerNode::removeDetachedNode() but that makes some tests fail. It should be fixed to discipline the Node lifecycle.
Blink fixed this in following commit - https://chromium.googlesource.com/chromium/blink/+/7977c3ddb18c061e3fe161c7823c78416693580d%5E%21/#F0 Rather than asserting "attached", they did "connectedSubframeCount". WebKit Source - https://searchfox.org/wubkat/source/Source/WebCore/dom/ContainerNode.cpp#321
(In reply to Ahmad Saleem from comment #1) > Blink fixed this in following commit - > https://chromium.googlesource.com/chromium/blink/+/ > 7977c3ddb18c061e3fe161c7823c78416693580d%5E%21/#F0 > > Rather than asserting "attached", they did "connectedSubframeCount". > > WebKit Source - > https://searchfox.org/wubkat/source/Source/WebCore/dom/ContainerNode.cpp#321 Ignore me - they have another ASSERT with 'needsAttach'.