So, there was (I hope not "is"... I am having a difficult time remembering the sequence of events involving this bug and what I might have done on the WebKit side) definitely a bug in the browser, but just to be explicit: there was also a bug in the JavaScript (the array returned as object with no length, causing the code to loop), and managing to deploy a change that managed to DoS tons of deployed browsers and somehow not noticing and then not really caring afterwards was extremely careless.