The regression test is failing because of new code in RenderLayer::styleChanged.
This crash is caused by the code that tries to get the pseudo style for the scroll bar and resizer in RenderLayer::styleChanged. It's being called on a RenderView, which has a document for its element and thus can't be styled. I suspect that's a bug, but it's easy to fix this code to be robust in cases like this, which is what I did.
Created attachment 24304 [details] patch
Comment on attachment 24304 [details] patch r=me
http://trac.webkit.org/changeset/37533