I half-flipped the logic of a condition but failed to flip the operators, causing us to overrun the bounds of cgPaintingRects.
Created attachment 216642 [details] patch
Created attachment 216643 [details] clarify changelog
http://trac.webkit.org/changeset/159098