Add a hack to set shouldPaint to true for force-composited iframes.

third_party/WebKit/Source/core/layout/FloatingObjects.cpp

Index: third_party/WebKit/Source/core/layout/FloatingObjects.cpp
diff --git a/third_party/WebKit/Source/core/layout/FloatingObjects.cpp b/third_party/WebKit/Source/core/layout/FloatingObjects.cpp
index 9eedc0fc526cbe1de91b19e18a531eaf318969af..2dcf0d9e167aa0b28a6fd1f5f92c5f644361d5d8 100644
--- a/third_party/WebKit/Source/core/layout/FloatingObjects.cpp
+++ b/third_party/WebKit/Source/core/layout/FloatingObjects.cpp
@@ -27,8 +27,9 @@
 #include "core/layout/LayoutBox.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/shapes/ShapeOutsideInfo.h"
+#include "core/paint/PaintLayer.h"
+#include "platform/RuntimeEnabledFeatures.h"
 #include "wtf/PtrUtil.h"
-
 #include <algorithm>
 #include <memory>
 
@@ -47,7 +48,6 @@ static_assert(sizeof(FloatingObject) == sizeof(SameSizeAsFloatingObject), "Float
 FloatingObject::FloatingObject(LayoutBox* layoutObject)
     : m_layoutObject(layoutObject)
     , m_originatingLine(nullptr)
-    // TODO(wkorman): Do we need to change this to take param as it used to?
     , m_shouldPaint(true)
     , m_isDescendant(false)
     , m_isPlaced(false)
@@ -69,7 +69,6 @@ FloatingObject::FloatingObject(LayoutBox* layoutObject, Type type, const LayoutR
     , m_originatingLine(nullptr)
     , m_frameRect(frameRect)
     , m_type(type)
-    , m_shouldPaint(shouldPaint)
     , m_isDescendant(isDescendant)
     , m_isPlaced(true)
     , m_isLowestNonOverhangingFloatInChild(isLowestNonOverhangingFloatInChild)
@@ -77,6 +76,25 @@ FloatingObject::FloatingObject(LayoutBox* layoutObject, Type type, const LayoutR
     , m_isInPlacedTree(false)
 #endif
 {
+    m_shouldPaint = shouldPaint;
+    // TODO(chrishtr): Avoid the following hack when performing an unsafe clone.
+    // This avoids a use-after-free bug due to the fact that we sometimes fail to remove
+    // floats from their container when detaching (crbug.com/619380). This is actually a bug in the
+    // floats detach machinery, which needs to be fixed, in which case this workaround can be removed.
+    // In any case, it should be safe because moving floats from one owner to another should cause layout,
+    // which will in turn update the m_shouldPaint property.
+    if (!performingUnsafeClone)
+        m_shouldPaint = m_shouldPaint || shouldPaintForCompositedLayoutPart();
+}
+
+bool FloatingObject::shouldPaintForCompositedLayoutPart()
+{
+    // HACK: only non-self-painting floats should paint. However, due to the fundamental compositing bug, some LayoutPart objects
+    // may become self-painting due to being composited. This leads to a chicken-egg issue because layout may not depend on compositing.
+    // If this is the case, set shouldPaint() to true even if the layer is technically self-painting. This lets the float which contains
+    // a LayoutPart start painting as soon as it stops being composited, without having to re-layout the float.
+    // This hack can be removed after SPv2.
+    return m_layoutObject->layer() && m_layoutObject->layer()->isSelfPaintingOnlyBecauseIsCompositedPart() && !RuntimeEnabledFeatures::slimmingPaintV2Enabled();
 }
 
 std::unique_ptr<FloatingObject> FloatingObject::create(LayoutBox* layoutObject)
@@ -84,13 +102,18 @@ std::unique_ptr<FloatingObject> FloatingObject::create(LayoutBox* layoutObject)
     std::unique_ptr<FloatingObject> newObj = wrapUnique(new FloatingObject(layoutObject));
 
     // If a layer exists, the float will paint itself. Otherwise someone else will.
-    newObj->setShouldPaint(!layoutObject->hasSelfPaintingLayer());
+    newObj->setShouldPaint(!layoutObject->hasSelfPaintingLayer() || newObj->shouldPaintForCompositedLayoutPart());
 
     newObj->setIsDescendant(true);
 
     return newObj;
 }
 
+bool FloatingObject::shouldPaint() const
+{
+    return m_shouldPaint && !m_layoutObject->hasSelfPaintingLayer();
+}
+
 std::unique_ptr<FloatingObject> FloatingObject::copyToNewContainer(LayoutSize offset, bool shouldPaint, bool isDescendant) const
 {
     return wrapUnique(new FloatingObject(layoutObject(), getType(), LayoutRect(frameRect().location() - offset, frameRect().size()), shouldPaint, isDescendant, isLowestNonOverhangingFloatInChild()));