LibWeb: Crash in `blit_corner_clipping()` when interacting with demo window on MDN

[tcl3]

When mousing over the right-hand side of the demo window on this MDN site, I get a crash with the following stack-trace:

VERIFICATION FAILED: m_ptr at /home/tim/repos/serenity/Meta/Lagom/../../AK/RefPtr.h:280
/home/tim/repos/serenity/Build/lagom/lib/liblagom-ak.so.0(ak_verification_failed+0xef) [0x7f5634fa019f]
/home/tim/repos/serenity/Build/lagom/lib/liblagom-web.so.0 Web::Painting::PaintingCommandExecutorCPU::blit_corner_clipping(unsigned int) 0x98) [0x7f5635853518]
/home/tim/repos/serenity/Build/lagom/lib/liblagom-web.so.0 Web::Painting::RecordingPainter::execute(Web::Painting::PaintingCommandExecutor&) 0xd62) [0x7f563587f4c2]
/home/tim/repos/serenity/Build/lagom/bin/WebContent(+0x88d50) [0x55a901849d50]
/home/tim/repos/serenity/Build/lagom/bin/WebContent(+0x8bd13) [0x55a90184cd13]
/home/tim/repos/serenity/Build/lagom/lib/liblagom-web.so.0(+0x89ba60) [0x7f563589ba60]
/home/tim/repos/serenity/Build/lagom/lib/liblagom-core.so.0(+0x387d9) [0x7f56363047d9]
/home/tim/repos/serenity/Build/lagom/lib/liblagom-core.so.0 Core::EventReceiver::dispatch_event(Core::Event&, Core::EventReceiver*) 0x75) [0x7f5636303cb5]
/home/tim/repos/serenity/Build/lagom/bin/WebContent(+0xd788a) [0x55a90189888a]
/usr/lib/libQt6Core.so.6(+0x1b9ec9) [0x7f56365b9ec9]
/usr/lib/libQt6Core.so.6 QTimer::timerEvent(QTimerEvent*) 0xa4) [0x7f56365c1f84]
/usr/lib/libQt6Core.so.6 QObject::event(QEvent*) 0x1b6) [0x7f56365a53b6]
/usr/lib/libQt6Core.so.6 QCoreApplication::notifyInternal2(QObject*, QEvent*) 0x15c) [0x7f56365629fc]
/usr/lib/libQt6Core.so.6 QTimerInfoList::activateTimers() 0x516) [0x7f56366c8236]
/usr/lib/libQt6Core.so.6(+0x39e954) [0x7f563679e954]
/usr/lib/libglib-2.0.so.0(+0x59f69) [0x7f5632f0df69]
/usr/lib/libglib-2.0.so.0(+0xb8367) [0x7f5632f6c367]
/usr/lib/libglib-2.0.so.0(g_main_context_iteration+0x32) [0x7f5632f0c162]
/usr/lib/libQt6Core.so.6 QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) 0x84) [0x7f563679d074]
/usr/lib/libQt6Core.so.6 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) 0x19e) [0x7f563656cf5e]
/home/tim/repos/serenity/Build/lagom/lib/liblagom-core.so.0 Core::EventLoop::exec() 0x2f) [0x7f56362fca4f]
/home/tim/repos/serenity/Build/lagom/bin/WebContent(+0xe1e95) [0x55a9018a2e95]
/home/tim/repos/serenity/Build/lagom/bin/WebContent(main+0xf2) [0x55a9018a4912]

I've bisected this error to: d3b983b20127430ef642c5562969c798bc593ede

CC: @kalenikaliaksandr