It's due to the HashMap resizing not being handled properly in WebGraphicsContextDefaultImpl.cpp
Created attachment 69290 [details] patch The test is copied from khronos and slightly modified (turn off console logging).
It's unfortunate there isn't a better pattern for this but after searching through WebCore I see this pattern of HashMaps with pointers as the values in several places. Just to verify before r+'ing: the new test was run with WebKit as well as Chromium?
Yes, tested in both Safari and Chromium.
Comment on attachment 69290 [details] patch OK. Looks good to me.
Committed r68806: <http://trac.webkit.org/changeset/68806>