Heap allocate PrePaintTreeWalk context object

third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PrePaintTreeWalk.h"
 
 #include "core/dom/DocumentLifecycle.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/layout/LayoutMultiColumnSpannerPlaceholder.h"
@@ skipping 217 matching lines @@
       !object.needsPaintPropertyUpdate() &&
       !object.descendantNeedsPaintPropertyUpdate() &&
       !context.treeBuilderContext.forceSubtreeUpdate &&
       !context.paintInvalidatorContext.forcedSubtreeInvalidationFlags &&
       !object
            .shouldCheckForPaintInvalidationRegardlessOfPaintInvalidationState());
 }
 
 void PrePaintTreeWalk::walk(const LayoutObject& object,
                             const PrePaintTreeWalkContext& parentContext) {
-  PrePaintTreeWalkContext context(parentContext);
-
   if (shouldEndWalkBefore(object, parentContext))
     return;
 
+  // PrePaintTreeWalkContext is large and can lead to stack overflows when
+  // recursion is deep so this context object is allocated on the heap.
+  // See: https://crbug.com/698653.
+  std::unique_ptr<PrePaintTreeWalkContext> context =
+      WTF::wrapUnique(new PrePaintTreeWalkContext(parentContext));
+
   // This must happen before updatePropertiesForSelf, because the latter reads
   // some of the state computed here.
-  updateAuxiliaryObjectProperties(object, context);
+  updateAuxiliaryObjectProperties(object, *context);
 
   m_propertyTreeBuilder.updatePropertiesForSelf(object,
-                                                context.treeBuilderContext);
+                                                context->treeBuilderContext);
   m_paintInvalidator.invalidatePaintIfNeeded(object,
-                                             context.paintInvalidatorContext);
-  m_propertyTreeBuilder.updatePropertiesForChildren(object,
-                                                    context.treeBuilderContext);
+                                             context->paintInvalidatorContext);
+  m_propertyTreeBuilder.updatePropertiesForChildren(
+      object, context->treeBuilderContext);
 
-  invalidatePaintLayerOptimizationsIfNeeded(object, context);
+  invalidatePaintLayerOptimizationsIfNeeded(object, *context);
 
   for (const LayoutObject* child = object.slowFirstChild(); child;
        child = child->nextSibling()) {
     if (child->isLayoutMultiColumnSpannerPlaceholder()) {
       child->getMutableForPainting().clearPaintFlags();
       continue;
     }
-    walk(*child, context);
+    walk(*child, *context);
   }
 
   if (object.isLayoutPart()) {
     const LayoutPart& layoutPart = toLayoutPart(object);
     FrameViewBase* frameViewBase = layoutPart.frameViewBase();
     if (frameViewBase && frameViewBase->isFrameView()) {
-      context.treeBuilderContext.current.paintOffset +=
+      context->treeBuilderContext.current.paintOffset +=
           layoutPart.replacedContentRect().location() -
           frameViewBase->frameRect().location();
-      context.treeBuilderContext.current.paintOffset =
-          roundedIntPoint(context.treeBuilderContext.current.paintOffset);
-      walk(*toFrameView(frameViewBase), context);
+      context->treeBuilderContext.current.paintOffset =
+          roundedIntPoint(context->treeBuilderContext.current.paintOffset);
+      walk(*toFrameView(frameViewBase), *context);
     }
     // TODO(pdr): Investigate RemoteFrameView (crbug.com/579281).
   }
 
   object.getMutableForPainting().clearPaintFlags();
 }
 
 }  // namespace blink