There is a case (found with a Bing page) where causing a layer to go from non-tiled to tiled causes a crash when that layer has a tiled layer parent. A test case is forthcoming.
Created attachment 65466 [details] test showing problem
Created attachment 65479 [details] Patch with test case
rdar://problem/8223788
Comment on attachment 65479 [details] Patch with test case WebCore/platform/graphics/win/WKCACFLayer.h:65 + ASSERT(CACFLayerGetUserData(layer) != reinterpret_cast<void*>(0xDeadBeef)); I think 0xDeadBeef should be all lower- or uppercase. WebCore/platform/graphics/win/WKCACFLayer.cpp:185 + CACFLayerSetUserData(layer(), reinterpret_cast<void*>(0xDeadBeef)); Only do this in debug builds. Seems like the underlying cause is that we mess with sublayerCount() for tiled layers. It would be nice to find a way to avoid that source of confusion.
Landed in http://trac.webkit.org/changeset/66050