I added an assertion to test that cached clip rects are used with the same rootLayer as they were computed with. This caught a couple of problems, which I'll submit a patch for.
Created attachment 26241 [details]
I wasn't able to easily create a LayoutTest to exercise these fixes, but the assertion provides testing.
Also, did you know that clipRects are cleared on every mouse move, because MouseRelatedEvent::receivedTarget() calls layer->updateLayerPosition() before setting event->layerX and event->layerY (which are totally bogus anyway, bug 21868).
Comment on attachment 26241 [details]
r=me. If you can make a test case please do so. If not, ok.
Committing to http://svn.webkit.org/repository/webkit/trunk ...