The container node of a position was being used without validation in DOMSupport.
Created attachment 132812 [details] Patch
Comment on attachment 132812 [details] Patch Looks good.
Comment on attachment 132812 [details] Patch Clearing flags on attachment: 132812 Committed r111390: <http://trac.webkit.org/changeset/111390>
All reviewed patches have been landed. Closing bug.