The InlineBox/RenderObject relationship is rather complicated (see RenderBox::setInlineBoxWrapper() vs. InlineElementBox::extractLine) and it's easy to delete one without letting the other know.
Created attachment 425905 [details]
Committed r275943 (236505@main): <https://commits.webkit.org/236505@main>
All reviewed patches have been landed. Closing bug and clearing flags on attachment 425905 [details].