LayoutTests/fast/canvas/arc-crash.html = CRASH
LayoutTests/fast/canvas/canvas-state-intact-after-putImageData.html = CRASH
LayoutTests/fast/canvas/toDataURL-supportedTypes.html = CRASH
Created attachment 65324 [details]
Fix looks correct and needed in general. I'm pretty curious why we can't repro this locally.
Comment on attachment 65324 [details]
Committed r65938: <http://trac.webkit.org/changeset/65938>
BTW, I did manage to repro, in the end, and confirmed that this fix ameliorates the crashes. Just had to run all the tests, instead of just the failing ones.