Bug 20066 changed RenderLayer::calculateClipRects() to not call parent()->calculateClipRects() in some situations. That means that the parent's clipRects are no longer guaranteed to be set up, so the code lower in the method needs to protect against this.
I haven't been able to actually crash, but here's a null-check patch.
Created attachment 22580 [details]
Comment on attachment 22580 [details]
r35496 = aec6a3acb56598eac0ab03de1d44cb8679883d72 (trunk)