Goodness gracious. We need to return the WeakBlock to the BlockAllocator after the call to WeakBlock::destroy.
Created attachment 189102 [details] Patch
Comment on attachment 189102 [details] Patch r=me
Comment on attachment 189102 [details] Patch Clearing flags on attachment: 189102 Committed r143351: <http://trac.webkit.org/changeset/143351>
All reviewed patches have been landed. Closing bug.