Add a hack to set shouldPaint to true for force-composited iframes.

third_party/WebKit/Source/core/layout/FloatingObjects.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #include "core/layout/FloatingObjects.h"
 
 #include "core/layout/LayoutBlockFlow.h"
 #include "core/layout/LayoutBox.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/shapes/ShapeOutsideInfo.h"
+#include "core/paint/PaintLayer.h"
+#include "platform/RuntimeEnabledFeatures.h"
 #include "wtf/PtrUtil.h"
-
 #include <algorithm>
 #include <memory>
 
 using namespace WTF;
 
 namespace blink {
 
 struct SameSizeAsFloatingObject {
     void* pointers[2];
     LayoutRect rect;
     uint32_t bitfields : 8;
 };
 
 static_assert(sizeof(FloatingObject) == sizeof(SameSizeAsFloatingObject), "FloatingObject should stay small");
 
 FloatingObject::FloatingObject(LayoutBox* layoutObject)
     : m_layoutObject(layoutObject)
     , m_originatingLine(nullptr)
-    // TODO(wkorman): Do we need to change this to take param as it used to?
     , m_shouldPaint(true)
     , m_isDescendant(false)
     , m_isPlaced(false)
     , m_isLowestNonOverhangingFloatInChild(false)
 #if ENABLE(ASSERT)
     , m_isInPlacedTree(false)
 #endif
 {
     EFloat type = layoutObject->style()->floating();
     ASSERT(type != NoFloat);
     if (type == LeftFloat)
         m_type = FloatLeft;
     else if (type == RightFloat)
         m_type = FloatRight;
 }
 
 FloatingObject::FloatingObject(LayoutBox* layoutObject, Type type, const LayoutRect& frameRect, bool shouldPaint, bool isDescendant, bool isLowestNonOverhangingFloatInChild, bool performingUnsafeClone)
     : m_layoutObject(layoutObject)
     , m_originatingLine(nullptr)
     , m_frameRect(frameRect)
     , m_type(type)
-    , m_shouldPaint(shouldPaint)
     , m_isDescendant(isDescendant)
     , m_isPlaced(true)
     , m_isLowestNonOverhangingFloatInChild(isLowestNonOverhangingFloatInChild)
 #if ENABLE(ASSERT)
     , m_isInPlacedTree(false)
 #endif
 {
+    m_shouldPaint = shouldPaint;
+    // TODO(chrishtr): Avoid the following hack when performing an unsafe clone.
+    // This avoids a use-after-free bug due to the fact that we sometimes fail to remove
+    // floats from their container when detaching (crbug.com/619380). This is actually a bug in the
+    // floats detach machinery, which needs to be fixed, in which case this workaround can be removed.
+    // In any case, it should be safe because moving floats from one owner to another should cause layout,
+    // which will in turn update the m_shouldPaint property.
+    if (!performingUnsafeClone)
+        m_shouldPaint = m_shouldPaint || shouldPaintForCompositedLayoutPart();
+}
+
+bool FloatingObject::shouldPaintForCompositedLayoutPart()
+{
+    // HACK: only non-self-painting floats should paint. However, due to the fundamental compositing bug, some LayoutPart objects
+    // may become self-painting due to being composited. This leads to a chicken-egg issue because layout may not depend on compositing.
+    // If this is the case, set shouldPaint() to true even if the layer is technically self-painting. This lets the float which contains
+    // a LayoutPart start painting as soon as it stops being composited, without having to re-layout the float.
+    // This hack can be removed after SPv2.
+    return m_layoutObject->layer() && m_layoutObject->layer()->isSelfPaintingOnlyBecauseIsCompositedPart() && !RuntimeEnabledFeatures::slimmingPaintV2Enabled();
 }
 
 std::unique_ptr<FloatingObject> FloatingObject::create(LayoutBox* layoutObject)
 {
     std::unique_ptr<FloatingObject> newObj = wrapUnique(new FloatingObject(layoutObject));
 
     // If a layer exists, the float will paint itself. Otherwise someone else will.
-    newObj->setShouldPaint(!layoutObject->hasSelfPaintingLayer());
+    newObj->setShouldPaint(!layoutObject->hasSelfPaintingLayer() || newObj->shouldPaintForCompositedLayoutPart());
 
     newObj->setIsDescendant(true);
 
     return newObj;
 }
 
+bool FloatingObject::shouldPaint() const
+{
+    return m_shouldPaint && !m_layoutObject->hasSelfPaintingLayer();
+}
+
 std::unique_ptr<FloatingObject> FloatingObject::copyToNewContainer(LayoutSize offset, bool shouldPaint, bool isDescendant) const
 {
     return wrapUnique(new FloatingObject(layoutObject(), getType(), LayoutRect(frameRect().location() - offset, frameRect().size()), shouldPaint, isDescendant, isLowestNonOverhangingFloatInChild()));
 }
 
 std::unique_ptr<FloatingObject> FloatingObject::unsafeClone() const
 {
     std::unique_ptr<FloatingObject> cloneObject = wrapUnique(new FloatingObject(layoutObject(), getType(), m_frameRect, m_shouldPaint, m_isDescendant, false, true));
     cloneObject->m_isPlaced = m_isPlaced;
     return cloneObject;
@@ skipping 520 matching lines @@
 }
 
 String ValueToString<FloatingObject*>::toString(const FloatingObject* floatingObject)
 {
     return String::format("%p (%gx%g %gx%g)", floatingObject, floatingObject->frameRect().x().toFloat(), floatingObject->frameRect().y().toFloat(), floatingObject->frameRect().maxX().toFloat(), floatingObject->frameRect().maxY().toFloat());
 }
 #endif
 
 
 } // namespace blink