The index validation code added in https://bugs.webkit.org/show_bug.cgi?id=31239 verifies too many indices. It should compute its maximum index from the sub-region of the bound element array buffer indicated by the passed offset and count; instead, it checks all indices in the element array buffer, leading to failures of valid code.
Created attachment 45121 [details]
style-queue ran check-webkit-style on attachment 45121 [details] without any errors.
Comment on attachment 45121 [details]
Clearing flags on attachment: 45121
Committed r52327: <http://trac.webkit.org/changeset/52327>
All reviewed patches have been landed. Closing bug.