It's possible to hit an assertion (in debug) and then a crash in collectStationaryLayerRelatedOverflowNodes().
<rdar://107526702>
Pull request: https://github.com/WebKit/WebKit/pull/13070
Committed 263286@main (eb40daa6cd50): <https://commits.webkit.org/263286@main> Reviewed commits have been landed. Closing PR #13070 and removing active labels.
Committed 259548.772@safari-7615-branch (64e3d5c74385): <https://commits.webkit.org/259548.772@safari-7615-branch> Reviewed commits have been landed. Closing PR #607 and removing active labels.