I came across this when tracking down another crash. If you have a DOM mutation event listener and it replaces the entire contents of the document during a drop, we crash. I know, this is contrived, but it's a crash none the less.
Created attachment 28226 [details] Fix for 24325
Comment on attachment 28226 [details] Fix for 24325 This looks fine. I'm surprised that the test case needs to use waitUntilDone() Ideally the test case should also set the text to PASSED when it's done. The blank page would confuse me at first.
Created attachment 28234 [details] Fix for 24325 Changes output to be PASSED and removes waitForDone/NotifyDone.
Comment on attachment 28234 [details] Fix for 24325 Looks fine.
Landed as http://trac.webkit.org/changeset/41403.