There is some trouble here with the asynchronous nature of WindowServer
and the single per-window backing store we're drawing into. If we start
repainting a widget with a pending invalidation, that invalidation might
get flushed by the WindowServer mid-paint.