While trying to make a simpler test case for bug 22634, I ran into another crasher :(
ASSERTION FAILED: m_node->parentNode()
Test case coming shortly.
Created attachment 28198 [details]
ASSERT stack trace
Created attachment 28199 [details]
test case (DOES NOT WORK under DumpRenderTree!), works manually though.
The fix attached to bug 22634 seems to fix this ASSERT as well.
*** This bug has been marked as a duplicate of 22634 ***