I have narrowed down the revisions to somewhere between r21639 - 21665.
Created attachment 14711 [details] testcase {CRASHES BROWSER}
From preliminary testing it looks like http://trac.webkit.org/projects/webkit/changeset/21646 is the culprit.
Created attachment 14791 [details] patch
<rdar://problem/5234019>
Comment on attachment 14791 [details] patch This was reviewed by David Harrison.
Landed in r21902.