I had originally disabled Vector bounds checking for ElementDescendantIterator's internal ancestor stack, but upon re-running performance benchmarks, it appears to have little-to-no measurable benefit.
Let's add it back.
Created attachment 244430 [details]
Comment on attachment 244430 [details]
Clearing flags on attachment: 244430
Committed r178253: <http://trac.webkit.org/changeset/178253>
All reviewed patches have been landed. Closing bug.