I had originally disabled Vector bounds checking for ElementDescendantIterator's internal ancestor stack, but upon re-running performance benchmarks, it appears to have little-to-no measurable benefit. Let's add it back.
Created attachment 244430 [details] Patch
Thank you!
Comment on attachment 244430 [details] Patch Clearing flags on attachment: 244430 Committed r178253: <http://trac.webkit.org/changeset/178253>
All reviewed patches have been landed. Closing bug.