gPercentHeightDescendantsMap in RenderBlock tracks boxes with a percent height. It would be possible that gPercentHeightDescendantsMap contains a stale pointer if a height of a RenderStyle was updated in layout(). I don't think we have such code at this moment. I had this problem with my local change.
Created attachment 97424 [details] Patch
Comment on attachment 97424 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=97424&action=review > Source/WebCore/rendering/RenderBlock.cpp:3424 > +#ifndef NDEBUG I found that we have a preprocessor symbol called ASSERT_DISABLED.
Created attachment 99680 [details] Patch 2 Chekcs ASSERT_DISABLED
Comment on attachment 97424 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=97424&action=review >> Source/WebCore/rendering/RenderBlock.cpp:3424 >> +#ifndef NDEBUG > > I found that we have a preprocessor symbol called ASSERT_DISABLED. Yes, ASSERT_DISABLED is better. I have updated the patch.
Comment on attachment 99680 [details] Patch 2 Assertion failure should be better than use-after-free.
Comment on attachment 99680 [details] Patch 2 Clearing flags on attachment: 99680 Committed r90388: <http://trac.webkit.org/changeset/90388>
All reviewed patches have been landed. Closing bug.