iPhone 5c marketing site repaints incorrectly with layer squashing

Source/core/rendering/RenderLayerRepainter.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 185 matching lines @@
             return;
 
         RenderView* view = m_renderer.view();
         if (view)
             view->repaintViewRectangle(absRect);
         return;
     }
     if (m_renderer.compositingState() == PaintsIntoGroupedBacking) {
         LayoutRect updatedRect(r);
 
+        RenderLayerModelObject* transformedAncestor = m_renderer.layer()->enclosingTransformedAncestor()->renderer();
+
+        // If the transformedAncestor is actually the RenderView, we might get
+        // confused and think that we can use LayoutState. Ideally, we'd made
+        // LayoutState work for all composited layers as well, but until then
+        // we need to disable LayoutState for squashed layers.
+        LayoutStateDisabler layoutStateDisabler(*transformedAncestor);
+
         // This code adjusts the repaint rectangle to be in the space of the transformed ancestor of the grouped (i.e. squashed)
         // layer. This is because all layers that squash together need to repaint w.r.t. a single container that is
         // an ancestor of all of them, in order to properly take into account any local transforms etc.
         // FIXME: remove this special-case code that works around the repainting code structure.
-        m_renderer.computeRectForRepaint(m_renderer.layer()->enclosingTransformedAncestor()->renderer(), updatedRect);
+        m_renderer.computeRectForRepaint(transformedAncestor, updatedRect);
         updatedRect.moveBy(-m_renderer.layer()->groupedMapping()->squashingOffsetFromTransformedAncestor());
 
         IntRect repaintRect = pixelSnappedIntRect(updatedRect);
         if (GraphicsLayer* squashingLayer = m_renderer.groupedMapping()->squashingLayer())
             squashingLayer->setNeedsDisplayInRect(repaintRect);
     } else {
         IntRect repaintRect = pixelSnappedIntRect(r);
         m_renderer.compositedLayerMapping()->setContentsNeedDisplayInRect(repaintRect);
     }
 }
@@ skipping 40 matching lines @@
 RenderLayer* RenderLayerRepainter::enclosingFilterRepaintLayer() const
 {
     for (const RenderLayer* curr = m_renderer.layer(); curr; curr = curr->parent()) {
         if ((curr != m_renderer.layer() && curr->requiresFullLayerImageForFilters()) || curr->compositingState() == PaintsIntoOwnBacking || curr->isRootLayer())
             return const_cast<RenderLayer*>(curr);
     }
     return 0;
 }
 
 } // Namespace WebCore