BitmapTexturePool is using the wrong vector size when freeing elements from the m_attachmentTextures list. It's using m_textures size instead of m_attachmentTextures as it should.
This problem was introduced in the patch for bug https://bugs.webkit.org/show_bug.cgi?id=154965
Created attachment 273168 [details]
Comment on attachment 273168 [details]
Clearing flags on attachment: 273168
Committed r197678: <http://trac.webkit.org/changeset/197678>
All reviewed patches have been landed. Closing bug.