Created attachment 201941 [details]
File that reproduces the problem
When content is flowed into multiple regions, taking a box which would normally flow in the 3rd region and using a negative margin-top on it to push it back to the first would cause an assertion when cleaning-up (and a memory leak on release build).
The problem seems to be that a RenderBoxRegionInfo object is generated for this box in the first region but, when calling RenderFlowThread::removeRenderBoxRegionInfo (RenderBox* box), it only destroys RenderBoxRegionInfo objects for the regions returned by the RenderFlowThread::getRegionRangeForBox method, which only returns regions 2 and 3, not taking into account that the negative margin-top pushed the box into a different region.
Attached test that reproduces the problem. Remove the following line to see what the page looks like without it crashing:
document.getElementById("divMain").style.display = "none";
Still repros on today's nightly (r151543)