Check DisplayItemCient aliveness in cached subsequences

third_party/WebKit/Source/core/layout/LayoutView.cpp

Index: third_party/WebKit/Source/core/layout/LayoutView.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutView.cpp b/third_party/WebKit/Source/core/layout/LayoutView.cpp
index 328f526b78a7372bf9597917619db1abcf696633..badaf8ba989625a06b757b2778e97727d286676d 100644
--- a/third_party/WebKit/Source/core/layout/LayoutView.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutView.cpp
@@ -961,6 +961,12 @@ void LayoutView::setIsInWindow(bool isInWindow)
 {
     if (m_compositor)
         m_compositor->setIsInWindow(isInWindow);
+#if CHECK_DISPLAY_ITEM_CLIENT_ALIVENESS
+    // We don't invalidate layers during document detach(), so must clear the should-keep-alive

[chrishtr, 2016/06/18 08:49:57]

Does this need to be true any more now that we use cache generations?

[Xianzhu, 2016/06/18 17:41:30]

This doesn't affect cache correctness, but is only related to aliveness
tracking. Because when a document is detached, LayoutObjects are deleted before
PaintLayers, without this code we would crash when LayoutObjects were deleted
because they were still under shouldKeepAlive control of the ancestor
PaintLayers. 

+    // DisplayItemClients which may be deleted before the layers being subsequence owners.
+    if (!isInWindow && layer())
+        layer()->endShouldKeepAliveAllClientsRecursive();
+#endif
 }
 
 IntervalArena* LayoutView::intervalArena()