This appears to be due to a branch simplification assuming that a particular block is unreachable, even though it is.
Created attachment 142831 [details] the patch
Landed in http://trac.webkit.org/changeset/117661