I have diagnosed the cause of the crashes discussed in bug 59571 as a shadow root remaining in the render tree after it is removed from the DOM. When a shadow root is removed from the DOM, it should also be removed from the render tree.
Created attachment 94338 [details] Patch
Comment on attachment 94338 [details] Patch OMG. Good find.
Comment on attachment 94338 [details] Patch Clearing flags on attachment: 94338 Committed r87029: <http://trac.webkit.org/changeset/87029>
All reviewed patches have been landed. Closing bug.