We plumbed everything through Skia and Chrome, but forgot to connect the two wires inside WebCore.
Created attachment 57360 [details] patch (Note: no layout test because test_shell forces this option off. Also, the test font which triggers this behaviour is 32MB.)
Comment on attachment 57360 [details] patch OK. Ideally the ChangeLog should say why testing is impossible (not just the bug).