This wasn't reviewed, and definitely shouldn't have been landed: <http://trac.webkit.org/changeset/78426/trunk/Source/WebKit2/UIProcess/BackingStore.cpp>. Clearly, the assertion was firing a lot, but I don't remember if that had anything to do with r78426, or was just something I already had in my tree for livability. I'm going to uncomment it locally and live with that for a while to see if the assertion fires. See also: <rdar://problem/8994456>.
Created attachment 103502 [details] proposed patch
Comment on attachment 103502 [details] proposed patch Clearing flags on attachment: 103502 Committed r92778: <http://trac.webkit.org/changeset/92778>
All reviewed patches have been landed. Closing bug.