Discovered by Xuefei Ren.
If, in rare cases, BackingStorePrivate::renderContents() returns false, the for() loop in render() will take a tile buffer from the surface pool but due to aborting the iteration early, won't put it into the new tile map. In order to prevent losing the buffer, we need to put it back into the surface pool before continuing.
Created attachment 205006 [details]
Comment on attachment 205006 [details]
Clearing flags on attachment: 205006
Committed r151735: <http://trac.webkit.org/changeset/151735>
All reviewed patches have been landed. Closing bug.