[S.P.] Don't draw frames of animated images that are offscreen

Source/core/layout/LayoutView.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 153 matching lines @@
 
     virtual bool backgroundIsKnownToBeOpaqueInRect(const LayoutRect& localRect) const override;
 
     double layoutViewportWidth() const;
     double layoutViewportHeight() const;
 
     void pushLayoutState(LayoutState& layoutState) { m_layoutState = &layoutState; }
     void popLayoutState() { ASSERT(m_layoutState); m_layoutState = m_layoutState->next(); }
     virtual void invalidateTreeIfNeeded(const PaintInvalidationState&) override final;
 
+    // Records |obj| as needing paint invalidation on the next frame. See the definition of PaintInvalidationDelayedFull for more details.
+    void pushDelayedPaintInvalidationTarget(LayoutObject& obj) { m_pendingDelayedPaintInvalidations.append(&obj); }
+
+    // Invalidates paint for all objects that were added via pushDelayedPaintInvalidationTarget, and clears the pending vector.
+    void invalidatePaintForDelayedTargets();
+
 private:
     virtual void mapLocalToContainer(const LayoutBoxModelObject* paintInvalidationContainer, TransformState&, MapCoordinatesFlags = ApplyContainerFlip, bool* wasFixed = 0, const PaintInvalidationState* = 0) const override;
     virtual const LayoutObject* pushMappingToContainer(const LayoutBoxModelObject* ancestorToStopAt, LayoutGeometryMap&) const override;
     virtual void mapAbsoluteToLocalPoint(MapCoordinatesFlags, TransformState&) const override;
     virtual void computeSelfHitTestRects(Vector<LayoutRect>&, const LayoutPoint& layerOffset) const override;
 
     void layoutContent();
 #if ENABLE(ASSERT)
     void checkLayoutState();
 #endif
@@ skipping 17 matching lines @@
     LayoutState* m_layoutState;
     OwnPtr<DeprecatedPaintLayerCompositor> m_compositor;
     RefPtr<IntervalArena> m_intervalArena;
 
     LayoutQuote* m_layoutQuoteHead;
     unsigned m_layoutCounterCount;
 
     unsigned m_hitTestCount;
 
     OwnPtrWillBePersistent<PendingSelection> m_pendingSelection;
+
+    Vector<LayoutObject*> m_pendingDelayedPaintInvalidations;

[esprehn, 2015/03/26 21:09:26]

This is a use-after-free since you don't remove objects from the list when the
RenderImage is destroyed.

 };
 
 DEFINE_LAYOUT_OBJECT_TYPE_CASTS(LayoutView, isLayoutView());
 
 // Suspends the LayoutState cached offset and clipRect optimization. Used under transforms
 // that cannot be represented by LayoutState (common in SVG) and when manipulating the render
 // tree during layout in ways that can trigger paint invalidation of a non-child (e.g. when a list item
 // moves its list marker around). Note that even when disabled, LayoutState is still used to
 // store layoutDelta.
 class ForceHorriblySlowRectMapping {
@@ skipping 13 matching lines @@
             m_paintInvalidationState->m_cachedOffsetsEnabled = true;
     }
 private:
     const PaintInvalidationState* m_paintInvalidationState;
     bool m_didDisable;
 };
 
 } // namespace blink
 
 #endif // LayoutView_h