This happens infrequently but when the dirtyRect of a composited layer contains portions that fall outside the layer's bounds, the code that updates the contents of the layer's texture (LayerChromium::updateTextureContents()) hits an assert. The solution is to clip the dirty region to the bounds of the layer since that's the only visible portion anyway.
Created attachment 57610 [details] Proposed patch
Comment on attachment 57610 [details] Proposed patch sounds good.
Comment on attachment 57610 [details] Proposed patch Clearing flags on attachment: 57610 Committed r60548: <http://trac.webkit.org/changeset/60548>
All reviewed patches have been landed. Closing bug.