I think that this is an issue with trailing whitespace similar to one in bug 126169. There is an iframe appended to body while an inline script runs, and a newline after </script> is parsed when the iframe is already in DOM tree. After that, another iframe is added. Depending on whether a layout happens before the second iframe is added, we get different render trees in the end.
Created attachment 243946 [details] proposed fix
Comment on attachment 243946 [details] proposed fix Hmm, release builds seem unhappy about this change :(
Comment on attachment 243946 [details] proposed fix Attachment 243946 [details] did not pass mac-ews (mac): Output: http://webkit-queues.appspot.com/results/5035683622158336 New failing tests: fast/events/before-unload-adopt-subframe-to-outside.html
Created attachment 243949 [details] Archive of layout-test-results from ews103 for mac-mountainlion The attached test failures were seen while running run-webkit-tests on the mac-ews. Bot: ews103 Port: mac-mountainlion Platform: Mac OS X 10.8.5
Comment on attachment 243946 [details] proposed fix Attachment 243946 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.appspot.com/results/6465884109406208 New failing tests: fast/events/before-unload-adopt-subframe-to-outside.html
Created attachment 243950 [details] Archive of layout-test-results from ews106 for mac-mountainlion-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: ews106 Port: mac-mountainlion-wk2 Platform: Mac OS X 10.8.5
Created attachment 244036 [details] proposed fix Let's see what EWS thinks about this; it also fixes the test in my ASan build.
Comment on attachment 244036 [details] proposed fix EWS is green.
Comment on attachment 244036 [details] proposed fix Clearing flags on attachment: 244036 Committed r177961: <http://trac.webkit.org/changeset/177961>
All reviewed patches have been landed. Closing bug.