Tomcat 9.0.48 introduced a regression, that broke some of our jsp pages. We have JSPs that use tagfiles for reusable content. As an example we can pass a block to render in each row of a table.

Snippet from the tagfile.
<%@ attribute name="rows" fragment="true" %>

Snippet from the JSP that uses the tagfile
	<jsp:attribute name="rows">
		<c:if test="${showDate}">
			<td><c:out value="${row.updateDate}"/></td>
		</c:if>
	</jsp:attribute>

With 9.0.48 this no longer works at all.  The page can no longer be compiled.  The Generator class creates code like this for that jsp:attribute
    public boolean invoke3( javax.servlet.jsp.JspWriter out ) 
      throws java.lang.Throwable
    {
      if (_jspx_meth_c_005fif_005f2(_jspx_parent, _jspx_page_context, _jspx_push_body_count_form_005fform_005f0))
        return true;
      return false;
    }
	
And we get the exception.	
org.apache.jasper.JasperException: Unable to compile class for JSP: 
An error occurred at line: [881] in the generated java file: [.....]
_jspx_push_body_count_form_005fform_005f0 cannot be resolved to a variable
	

_jspx_push_body_count_form_005fform_005f0 doesn't exist in the generated Helper class. 
In 9.0.46 this uses _jspx_push_body_count, which is in the Helper class.
9.0.46 version: if (_jspx_meth_c_005fif_005f1(_jspx_parent, _jspx_page_context, _jspx_push_body_count))

I believe the issue is commit e2624ac20bee1f1549109922ad7bc8d4ea80c6ed which removed this code
-            if (pushBodyCountVar != null) {
-                // Use a fixed name for push body count, to simplify code gen
-                pushBodyCountVar = "_jspx_push_body_count";
-            }

I don't have an easy way to bisect a manual build with that reverted, but I tested against versions 9.0.34 through 9.0.48 and our works until 9.0.48
And I also put a break point on "String pushBodyCountVarSave = pushBodyCountVar;" and pushBodyCountVar != null is true.