The following code in ContainerNode::removeChild is bogus for a few reasons: 1. It happens after dispatchSubtreeModifiedEvent(). By that point, other scripts may have ran so it's too late. 2. This is not the only function that can remove DOM nodes from a tree. auto* element = dynamicDowncast<Element>(oldChild); if (element && (element->lastRememberedLogicalWidth() || element->lastRememberedLogicalHeight())) { // The disconnected element could be unobserved because of other properties, here we need to make sure it is observed, // so that deliver could be triggered and it would clear lastRememberedSize. document().observeForContainIntrinsicSize(*element); document().resetObservationSizeForContainIntrinsicSize(*element); }
<rdar://problem/115157934>
Pull request: https://github.com/WebKit/WebKit/pull/18409
Please re-open if anybody think it is not a dupe. *** This bug has been marked as a duplicate of bug 270240 ***