Move paint invalidation after compositing update

Source/core/frame/FrameView.h

Index: Source/core/frame/FrameView.h
diff --git a/Source/core/frame/FrameView.h b/Source/core/frame/FrameView.h
index 4d04b781ab55040c9b9ac19c029117eb277799c0..05d14b652e1cf7df4db37a2f703158c1e844fd80 100644
--- a/Source/core/frame/FrameView.h
+++ b/Source/core/frame/FrameView.h
@@ -219,6 +219,8 @@ public:
     void updateLayoutAndStyleForPainting();
     void updateLayoutAndStyleIfNeededRecursive();
 
+    void invalidateTreeIfNeededRecursive();
+
     void incrementVisuallyNonEmptyCharacterCount(unsigned);
     void incrementVisuallyNonEmptyPixelCount(const IntSize&);
     void setIsVisuallyNonEmpty() { m_isVisuallyNonEmpty = true; }
@@ -361,7 +363,7 @@ private:
     void scheduleOrPerformPostLayoutTasks();
     void performPostLayoutTasks();
 
-    void invalidateTree(RenderObject* root);
+    void invalidateTreeIfNeeded();
 
     void gatherDebugLayoutRects(RenderObject* layoutRoot);
 
@@ -436,6 +438,10 @@ private:
     bool m_hasPendingLayout;
     RenderObject* m_layoutSubtreeRoot;
 
+    // This is a copy of the layout root so that we can
+    // generate invalidations in their own phase later.
+    RenderObject* m_paintInvalidationSubtreeRoot;

[esprehn, 2014/06/25 00:20:31]

I think this is a use-after-free, what updates this if the renderer is
destroyed?

[Julien - ping for review, 2014/06/25 22:34:30]

Yeah, I thought I had included the part about clearing it like
m_layoutSubtreeRoot but I forgot.

+
     bool m_layoutSchedulingEnabled;
     bool m_inPerformLayout;
     bool m_canInvalidatePaintDuringPerformLayout;