r228238 changed the order and now when a renderer is getting destroyed, we nuke its subtree while the renderer is still attached. Apparently we first need to detach it first so that while we are nuking the subtree, the renderers can't get access to previous/next siblings and do "smart" normalization. rdar://problem/37619394
<rdar://problem/37619394>
Created attachment 334115 [details] Patch
Comment on attachment 334115 [details] Patch Clearing flags on attachment: 334115 Committed r228606: <https://trac.webkit.org/changeset/228606>
All reviewed patches have been landed. Closing bug.