Discovered by Xuefei Ren. If, in rare cases, BackingStorePrivate::renderContents() returns false, the for() loop in render() will take a tile buffer from the surface pool but due to aborting the iteration early, won't put it into the new tile map. In order to prevent losing the buffer, we need to put it back into the surface pool before continuing. Patch below.
Created attachment 205006 [details] Patch
Comment on attachment 205006 [details] Patch Clearing flags on attachment: 205006 Committed r151735: <http://trac.webkit.org/changeset/151735>
All reviewed patches have been landed. Closing bug.