The same problem that bug 33600 reported about RenderObject is being inherited by virtue of copy-paste programing here.
If stayWithin has a nextSibling() the method returns it instead of null when called on stayWithin's last descendant, hence causing an iteration of the counterTree designed to stay within stayWithin's descendants, iterates to the end of the counterTree.
Patch to come soon.
Created attachment 46517 [details]
Comment on attachment 46517 [details]
Clearing flags on attachment: 46517
Committed r53230: <http://trac.webkit.org/changeset/53230>
All reviewed patches have been landed. Closing bug.