Move paint invalidation after compositing update

Source/core/frame/FrameView.h

 /*
    Copyright (C) 1997 Martin Jones (mjones@kde.org)
              (C) 1998 Waldo Bastian (bastian@kde.org)
              (C) 1998, 1999 Torben Weis (weis@kde.org)
              (C) 1999 Lars Knoll (knoll@kde.org)
              (C) 1999 Antti Koivisto (koivisto@kde.org)
    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Library General Public
@@ skipping 201 matching lines @@
     virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect) OVERRIDE;
     virtual void paintScrollbar(GraphicsContext*, Scrollbar*, const IntRect&) OVERRIDE;
 
     Color documentBackgroundColor() const;
 
     static double currentFrameTimeStamp() { return s_currentFrameTimeStamp; }
 
     void updateLayoutAndStyleForPainting();
     void updateLayoutAndStyleIfNeededRecursive();
 
+    void invalidateTreeIfNeededRecursive();
+
     void incrementVisuallyNonEmptyCharacterCount(unsigned);
     void incrementVisuallyNonEmptyPixelCount(const IntSize&);
     void setIsVisuallyNonEmpty() { m_isVisuallyNonEmpty = true; }
     void enableAutoSizeMode(bool enable, const IntSize& minSize, const IntSize& maxSize);
 
     void forceLayout(bool allowSubtree = false);
     void forceLayoutForPagination(const FloatSize& pageSize, const FloatSize& originalPageSize, float maximumShrinkFactor);
 
     bool scrollToFragment(const KURL&);
     bool scrollToAnchor(const String&);
@@ skipping 122 matching lines @@
     void updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow);
 
     void updateCounters();
     void autoSizeIfEnabled();
     void forceLayoutParentViewIfNeeded();
     void performPreLayoutTasks();
     void performLayout(RenderObject* rootForThisLayout, bool inSubtreeLayout);
     void scheduleOrPerformPostLayoutTasks();
     void performPostLayoutTasks();
 
-    void invalidateTree(RenderObject* root);
+    void invalidateTreeIfNeeded();
 
     void gatherDebugLayoutRects(RenderObject* layoutRoot);
 
     DocumentLifecycle& lifecycle() const;
 
     virtual void contentRectangleForPaintInvalidation(const IntRect&) OVERRIDE;
     virtual void contentsResized() OVERRIDE;
     virtual void scrollbarExistenceDidChange() OVERRIDE;
 
     // Override ScrollView methods to do point conversion via renderers, in order to
@@ skipping 54 matching lines @@
 
     bool m_canHaveScrollbars;
     bool m_cannotBlitToWindow;
     bool m_isOverlapped;
     bool m_contentIsOpaque;
     unsigned m_slowRepaintObjectCount;
 
     bool m_hasPendingLayout;
     RenderObject* m_layoutSubtreeRoot;
 
+    // This is a copy of the layout root so that we can
+    // generate invalidations in their own phase later.
+    RenderObject* m_paintInvalidationSubtreeRoot;

[esprehn, 2014/06/25 00:20:31]

I think this is a use-after-free, what updates this if the renderer is
destroyed?

[Julien - ping for review, 2014/06/25 22:34:30]

Yeah, I thought I had included the part about clearing it like
m_layoutSubtreeRoot but I forgot.

+
     bool m_layoutSchedulingEnabled;
     bool m_inPerformLayout;
     bool m_canInvalidatePaintDuringPerformLayout;
     bool m_inSynchronousPostLayout;
     int m_layoutCount;
     unsigned m_nestedLayoutCount;
     Timer<FrameView> m_postLayoutTasksTimer;
     Timer<FrameView> m_updateWidgetsTimer;
     bool m_firstLayoutCallbackPending;
 
@@ skipping 107 matching lines @@
         m_view->setCanInvalidatePaintDuringPerformLayout(m_originalValue);
     }
 private:
     FrameView* m_view;
     bool m_originalValue;
 };
 
 } // namespace WebCore
 
 #endif // FrameView_h