One possibility is that loads triggered by loadPendingImages end up synchronously destroying or re-entering style resolver. Add some asserts.
Created attachment 246522 [details] patch
https://trac.webkit.org/r180051
Which radar / crash is that?
<rdar://problem/9392441&10021139&10138224&10180886&10265259&10738223&10932657&11327125&13281374&13286169&13294656&13294658&13612542&14343895&14492424&14807124&15164315>
Made this actually work in https://trac.webkit.org/r180554