Currently, TextureMapperLayer creates a imageBuffer as big as m_state.needsDisplayRect. The size of m_state.needsDisplayRect can be bigger than the size of the layerRect, so we may consumed the memory more than the size of the layerRect. This patch makes TextureMapperLayer save the memory.
Created attachment 152948 [details] Patch
When I tested in http://www.satine.org/research/webkit/snowleopard/snowstack.html , m_state.needsDisplayRect was {m_location = {m_x = 97623, m_y = 20744}, m_size = {m_width = 43797, m_height = 26438}} and WebKit crashed. I don't know why RenderLayerBacking notifies too big dirtyRect to GraphicsLayer.
Comment on attachment 152948 [details] Patch Clearing flags on attachment: 152948 Committed r122975: <http://trac.webkit.org/changeset/122975>
All reviewed patches have been landed. Closing bug.