[SPv2] Fix property node invalidation for CSS masks

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include <memory>
 #include "core/dom/DOMNodeIds.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
@@ skipping 1051 matching lines @@
     }
     object.getMutableForPainting().setPaintOffset(context.current.paintOffset);
   }
 
   if (!object.isBox())
     return;
   const LayoutBox& box = toLayoutBox(object);
   if (box.size() == box.previousSize())
     return;
 
+  // CSS mask and clip-path comes with an implicit clip to the border box.
+  // Currently only SPv2 generate and take advantage of those.
+  const bool boxGeneratesPropertyNodesForMaskAndClipPath =
+      RuntimeEnabledFeatures::slimmingPaintV2Enabled() &&
+      (box.hasMask() || box.hasClipPath());
   // The overflow clip paint property depends on the border box rect through
   // overflowClipRect(). The border box rect's size equals the frame rect's
   // size so we trigger a paint property update when the frame rect changes.
   if (box.shouldClipOverflow() ||
       // The used value of CSS clip may depend on size of the box, e.g. for
       // clip: rect(auto auto auto -5px).
       box.hasClip() ||
       // Relative lengths (e.g., percentage values) in transform, perspective,
       // transform-origin, and perspective-origin can depend on the size of the
       // frame rect, so force a property update if it changes. TODO(pdr): We
       // only need to update properties if there are relative lengths.
-      box.styleRef().hasTransform() || box.styleRef().hasPerspective())
+      box.styleRef().hasTransform() || box.styleRef().hasPerspective() ||
+      boxGeneratesPropertyNodesForMaskAndClipPath)
     box.getMutableForPainting().setNeedsPaintPropertyUpdate();
 }
 
 void PaintPropertyTreeBuilder::updatePropertiesForSelf(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
   // This is not in FindObjectPropertiesNeedingUpdateScope because paint offset
   // can change without needsPaintPropertyUpdate.
   updateForObjectLocationAndSize(object, context);
 
@@ skipping 27 matching lines @@
   updateOverflowClip(object, context);
   updatePerspective(object, context);
   updateSvgLocalToBorderBoxTransform(object, context);
   updateScrollAndScrollTranslation(object, context);
   updateOutOfFlowContext(object, context);
 
   context.forceSubtreeUpdate |= object.subtreeNeedsPaintPropertyUpdate();
 }
 
 }  // namespace blink