https://bugs.webkit.org/show_bug.cgi?id=132549 was not the whole story, there's another bug in the pool where we'll loop forever if we end up with only one in-use surface left and the pool is still too full...
Created attachment 230842 [details] patch
http://trac.webkit.org/changeset/168308