States of GraphicsContext may never be restored after clipToImageBuffer. Skia doesn't support clipping to an image, so it creates a layer to implement this. See PlatformContextSkia::beginLayerClippedToImage and PlatformContextSkia::applyClipFromImage But in some cases, such as clipping to an empty ImageBuffer, beginLayerClippedToImage/applyClipFromImage are mismatched, which will make states of GraphicsContext busted.
Created attachment 105923 [details] patch
CCing experts on this area.
Comment on attachment 105923 [details] patch R=me
Comment on attachment 105923 [details] patch Clearing flags on attachment: 105923 Committed r94581: <http://trac.webkit.org/changeset/94581>
All reviewed patches have been landed. Closing bug.