Revert "Add a hack to set shouldPaint to true for force-composited iframes."

third_party/WebKit/Source/core/layout/FloatingObjects.cpp

Index: third_party/WebKit/Source/core/layout/FloatingObjects.cpp
diff --git a/third_party/WebKit/Source/core/layout/FloatingObjects.cpp b/third_party/WebKit/Source/core/layout/FloatingObjects.cpp
index 2dcf0d9e167aa0b28a6fd1f5f92c5f644361d5d8..9eedc0fc526cbe1de91b19e18a531eaf318969af 100644
--- a/third_party/WebKit/Source/core/layout/FloatingObjects.cpp
+++ b/third_party/WebKit/Source/core/layout/FloatingObjects.cpp
@@ -27,9 +27,8 @@
 #include "core/layout/LayoutBox.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/shapes/ShapeOutsideInfo.h"
-#include "core/paint/PaintLayer.h"
-#include "platform/RuntimeEnabledFeatures.h"
 #include "wtf/PtrUtil.h"
+
 #include <algorithm>
 #include <memory>
 
@@ -48,6 +47,7 @@ static_assert(sizeof(FloatingObject) == sizeof(SameSizeAsFloatingObject), "Float
 FloatingObject::FloatingObject(LayoutBox* layoutObject)
     : m_layoutObject(layoutObject)
     , m_originatingLine(nullptr)
+    // TODO(wkorman): Do we need to change this to take param as it used to?
     , m_shouldPaint(true)
     , m_isDescendant(false)
     , m_isPlaced(false)
@@ -69,6 +69,7 @@ FloatingObject::FloatingObject(LayoutBox* layoutObject, Type type, const LayoutR
     , m_originatingLine(nullptr)
     , m_frameRect(frameRect)
     , m_type(type)
+    , m_shouldPaint(shouldPaint)
     , m_isDescendant(isDescendant)
     , m_isPlaced(true)
     , m_isLowestNonOverhangingFloatInChild(isLowestNonOverhangingFloatInChild)
@@ -76,25 +77,6 @@ FloatingObject::FloatingObject(LayoutBox* layoutObject, Type type, const LayoutR
     , m_isInPlacedTree(false)
 #endif
 {
-    m_shouldPaint = shouldPaint;
-    // TODO(chrishtr): Avoid the following hack when performing an unsafe clone.
-    // This avoids a use-after-free bug due to the fact that we sometimes fail to remove
-    // floats from their container when detaching (crbug.com/619380). This is actually a bug in the
-    // floats detach machinery, which needs to be fixed, in which case this workaround can be removed.
-    // In any case, it should be safe because moving floats from one owner to another should cause layout,
-    // which will in turn update the m_shouldPaint property.
-    if (!performingUnsafeClone)
-        m_shouldPaint = m_shouldPaint || shouldPaintForCompositedLayoutPart();
-}
-
-bool FloatingObject::shouldPaintForCompositedLayoutPart()
-{
-    // HACK: only non-self-painting floats should paint. However, due to the fundamental compositing bug, some LayoutPart objects
-    // may become self-painting due to being composited. This leads to a chicken-egg issue because layout may not depend on compositing.
-    // If this is the case, set shouldPaint() to true even if the layer is technically self-painting. This lets the float which contains
-    // a LayoutPart start painting as soon as it stops being composited, without having to re-layout the float.
-    // This hack can be removed after SPv2.
-    return m_layoutObject->layer() && m_layoutObject->layer()->isSelfPaintingOnlyBecauseIsCompositedPart() && !RuntimeEnabledFeatures::slimmingPaintV2Enabled();
 }
 
 std::unique_ptr<FloatingObject> FloatingObject::create(LayoutBox* layoutObject)
@@ -102,18 +84,13 @@ std::unique_ptr<FloatingObject> FloatingObject::create(LayoutBox* layoutObject)
     std::unique_ptr<FloatingObject> newObj = wrapUnique(new FloatingObject(layoutObject));
 
     // If a layer exists, the float will paint itself. Otherwise someone else will.
-    newObj->setShouldPaint(!layoutObject->hasSelfPaintingLayer() || newObj->shouldPaintForCompositedLayoutPart());
+    newObj->setShouldPaint(!layoutObject->hasSelfPaintingLayer());
 
     newObj->setIsDescendant(true);
 
     return newObj;
 }
 
-bool FloatingObject::shouldPaint() const
-{
-    return m_shouldPaint && !m_layoutObject->hasSelfPaintingLayer();
-}
-
 std::unique_ptr<FloatingObject> FloatingObject::copyToNewContainer(LayoutSize offset, bool shouldPaint, bool isDescendant) const
 {
     return wrapUnique(new FloatingObject(layoutObject(), getType(), LayoutRect(frameRect().location() - offset, frameRect().size()), shouldPaint, isDescendant, isLowestNonOverhangingFloatInChild()));