This should not happen unless recalcStyle() is called in the middle of changing the DOM tree and the render tree has not been updated yet. In this case, a renderer will be associated with an element which is not connected to the DOM tree.
<rdar://problem/30888101>
Created attachment 325518 [details] Patch
Comment on attachment 325518 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=325518&action=review > Source/WebCore/ChangeLog:11 > + while the DOM tree is being changed an event fires and this event causes "DOM tree is being changed an event fires"? You mean like "a script runs in response to a DOM mutation"?
Comment on attachment 325518 [details] Patch Attachment 325518 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.webkit.org/results/5057128 New failing tests: imported/w3c/web-platform-tests/service-workers/cache-storage/serviceworker/cache-match.https.html
Created attachment 325528 [details] Archive of layout-test-results from ews107 for mac-elcapitan-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: ews107 Port: mac-elcapitan-wk2 Platform: Mac OS X 10.11.6
Created attachment 325531 [details] Patch
Comment on attachment 325518 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=325518&action=review >> Source/WebCore/ChangeLog:11 >> + while the DOM tree is being changed an event fires and this event causes > > "DOM tree is being changed an event fires"? > You mean like "a script runs in response to a DOM mutation"? Not necessarily. For example while waiting for a response from the network process, WebKit may decide to process another message from the UI process. Processing the UI message will cause an event to fire. In this case styleReclac()/layout() may happen. I changed the ChangeLog to make the wording more generic.
Comment on attachment 325531 [details] Patch Clearing flags on attachment: 325531 Committed r224269: <https://trac.webkit.org/changeset/224269>
All reviewed patches have been landed. Closing bug.