The ASSERT is in GraphicsContext::~GraphicsContext(). There is a mismatch between the number of calls in save() / restore() [one missing from my limited testing]. I haven't found the origin of the mismatch. This happens on Mac but not on Chromium (testing Linux and Mac).
Two tests are skipped because of this: fast/css/webkit-mask-crash-fieldset-legend.html fast/css/webkit-mask-crash-table.html
I unskipped the tests, as they don't assert any more.