The PlatformTouchEventBuilder resizes the touch point array before appending points to it, which is incredibly wrong. This was a vestige of how touch event conversion used to work.
Created attachment 50927 [details]
Comment on attachment 50927 [details]
Clearing flags on attachment: 50927
Committed r56144: <http://trac.webkit.org/changeset/56144>
All reviewed patches have been landed. Closing bug.