Just wrong. Not sure what the release mode symptom is, but an assertion does fail.
Created attachment 110915 [details] proposed fix
Committed <http://trac.webkit.org/changeset/97411>.