The PlatformTouchEventBuilder resizes the touch point array before appending points to it, which is incredibly wrong. This was a vestige of how touch event conversion used to work.
Created attachment 50927 [details] Initial patch
Comment on attachment 50927 [details] Initial patch Clearing flags on attachment: 50927 Committed r56144: <http://trac.webkit.org/changeset/56144>
All reviewed patches have been landed. Closing bug.