WebPageCompositor and the related BackingStore member function compositeContents() are using WebKit thread data on the user interface thread, without synchronization primitives or anything. That's bad and should be fixed. Potential threading problems can be avoided by moving from WebPage members and mapToTransformed() to the web page client's userInterfaceViewportAccessor(). As part of this cleaning effort, the WebPageCompositor's render() method is changed to now take document instead of pixel coordinates.
Created attachment 195404 [details] Patch
Comment on attachment 195404 [details] Patch Looks great!
Comment on attachment 195404 [details] Patch LGTM.
Comment on attachment 195404 [details] Patch Clearing flags on attachment: 195404 Committed r147136: <http://trac.webkit.org/changeset/147136>
All reviewed patches have been landed. Closing bug.