[S.P.] Don't draw frames of animated images that are offscreen

Source/core/layout/LayoutView.h

Index: Source/core/layout/LayoutView.h
diff --git a/Source/core/layout/LayoutView.h b/Source/core/layout/LayoutView.h
index 1af5fd647c7e678b8ef5256dbdb22976aac43741..7fc19351267eb0c8aa66b0bf2ddda4bdf999b7c9 100644
--- a/Source/core/layout/LayoutView.h
+++ b/Source/core/layout/LayoutView.h
@@ -171,6 +171,12 @@ public:
     void popLayoutState() { ASSERT(m_layoutState); m_layoutState = m_layoutState->next(); }
     virtual void invalidateTreeIfNeeded(const PaintInvalidationState&) override final;
 
+    // Records |obj| as needing paint invalidation on the next frame. See the definition of PaintInvalidationDelayedFull for more details.
+    void pushDelayedPaintInvalidationTarget(LayoutObject& obj) { m_pendingDelayedPaintInvalidations.append(&obj); }
+
+    // Invalidates paint for all objects that were added via pushDelayedPaintInvalidationTarget, and clears the pending vector.
+    void invalidatePaintForDelayedTargets();
+
 private:
     virtual void mapLocalToContainer(const LayoutBoxModelObject* paintInvalidationContainer, TransformState&, MapCoordinatesFlags = ApplyContainerFlip, bool* wasFixed = 0, const PaintInvalidationState* = 0) const override;
     virtual const LayoutObject* pushMappingToContainer(const LayoutBoxModelObject* ancestorToStopAt, LayoutGeometryMap&) const override;
@@ -208,6 +214,8 @@ private:
     unsigned m_hitTestCount;
 
     OwnPtrWillBePersistent<PendingSelection> m_pendingSelection;
+
+    Vector<LayoutObject*> m_pendingDelayedPaintInvalidations;

[esprehn, 2015/03/26 21:09:26]

This is a use-after-free since you don't remove objects from the list when the
RenderImage is destroyed.

 };
 
 DEFINE_LAYOUT_OBJECT_TYPE_CASTS(LayoutView, isLayoutView());