The crash mentioned in http://trac.webkit.org/changeset/40940 returned with the switch to WebKit2, because the added workaround was not preserved. <rdar://problem/9058370> Patch to re-add it coming shortly.
Created attachment 102048 [details] patch
Comment on attachment 102048 [details] patch Clearing flags on attachment: 102048 Committed r91793: <http://trac.webkit.org/changeset/91793>
All reviewed patches have been landed. Closing bug.