With first-letter style there is a null deref when getCachedPseudoStyle() returns a null RenderStyle. The attached repro will trigger it. Patch to follow shortly.
Created attachment 66919 [details] repro
Created attachment 66920 [details] Patch
Comment on attachment 66920 [details] Patch r=me
Comment on attachment 66920 [details] Patch Clearing flags on attachment: 66920 Committed r67184: <http://trac.webkit.org/changeset/67184>
All reviewed patches have been landed. Closing bug.