The attached test case crashes TOT. Patch forthcoming.
<rdar://problem/6304151>
Created attachment 24635 [details] Keep RenderWidget::destroy() in sync with RenderBox::destroy() after r36513
Fixed in <http://trac.webkit.org/changeset/37849>.