The InlineBox/RenderObject relationship is rather complicated (see RenderBox::setInlineBoxWrapper() vs. InlineElementBox::extractLine) and it's easy to delete one without letting the other know.
Created attachment 425905 [details] Patch
Committed r275943 (236505@main): <https://commits.webkit.org/236505@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 425905 [details].
<rdar://problem/76643802>