https://bugs.webkit.org/show_bug.cgi?id=133890 was a bit premature, but after the fix to https://bugs.webkit.org/show_bug.cgi?id=133952 it passes all the tests AND doesn't crash. Let's try this again.
Created attachment 233204 [details] Patch
http://trac.webkit.org/changeset/170061 <rdar://problem/17310631>