The change in <http://trac.webkit.org/projects/webkit/changeset/29425> appears to leak the ActivationStackNodes that are allocated by JSGlobalObject::reset. An attempted fix for this was landed in <http://trac.webkit.org/projects/webkit/changeset/29435>, but it caused crashes so was rolled out shortly after. Leaks output: http://build.webkit.org/results/trunk-mac-intel-debug/3024/DumpRenderTree6-leaks.txt
Fixed in r29443.