It happens when the layer tree host is destroyed after the didChangeVisibleRect is scheduled to be run in the main thread, but before it's actually dispatched. In that case the threaded compositor client points to a deleted object and crashes when trying to dereference it.
Created attachment 284007 [details]
Comment on attachment 284007 [details]
Don't we have a test to reproduce the crash?
(In reply to comment #2)
> Comment on attachment 284007 [details]
> Don't we have a test to reproduce the crash?
Yes, several tests crashed because of this, I found this issue running the layout tests indeed, but I don't remember which tests failed. Same for bug #159918
Committed r203449: <http://trac.webkit.org/changeset/203449>