Clear LocalFrameView::paint_artifact_compositor_ if not compositing

Also do compositing update when we need compositing update when not
compositing, to clear the stale GraphicsLayers.

This fixes crash when SetAcceleratedCompositingEnabled(false) is
called after the frame is composited. Not sure if this happens in real
world but this fixes clusterfuzz crashes.

Bug: 1137609, 1137650
Change-Id: I059876725758c95490644eeebae7e0c94d5caa65
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2469362Reviewed-by: Philip Rogers <pdr@chromium.org>
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#817122}

third_party/blink/renderer/core/frame/local_frame_view.cc

@@ -3027,8 +3027,13 @@ const cc::Layer* LocalFrameView::RootCcLayer() const {
 
 void LocalFrameView::PushPaintArtifactToCompositor(bool repainted) {
   TRACE_EVENT0("blink", "LocalFrameView::pushPaintArtifactToCompositor");
-  if (!frame_->GetSettings()->GetAcceleratedCompositingEnabled())
+  if (!frame_->GetSettings()->GetAcceleratedCompositingEnabled()) {
+    if (paint_artifact_compositor_) {
+      paint_artifact_compositor_->WillBeRemovedFromFrame();
+      paint_artifact_compositor_ = nullptr;
+    }
     return;
+  }
 
   Page* page = GetFrame().GetPage();
   if (!page)

third_party/blink/renderer/core/paint/compositing/compositing_test.cc

@@ -99,17 +99,29 @@ class CompositingTest : public PaintTestConfigurations, public testing::Test {
         layer->transform_tree_index());
   }
 
- private:
   PaintArtifactCompositor* paint_artifact_compositor() {
     return GetLocalFrameView()->GetPaintArtifactCompositor();
   }
 
+ private:
   frame_test_helpers::TestWebWidgetClient web_widget_client_;
   std::unique_ptr<frame_test_helpers::WebViewHelper> web_view_helper_;
 };
 
 INSTANTIATE_PAINT_TEST_SUITE_P(CompositingTest);
 
+TEST_P(CompositingTest, DisableAndEnableAcceleratedCompositing) {
+  auto* settings = GetLocalFrameView()->GetFrame().GetSettings();
+  size_t num_layers = RootCcLayer()->children().size();
+  EXPECT_GT(num_layers, 1u);
+  settings->SetAcceleratedCompositingEnabled(false);
+  UpdateAllLifecyclePhases();
+  EXPECT_FALSE(paint_artifact_compositor());
+  settings->SetAcceleratedCompositingEnabled(true);
+  UpdateAllLifecyclePhases();
+  EXPECT_EQ(num_layers, RootCcLayer()->children().size());
+}
+
 TEST_P(CompositingTest, DidScrollCallbackAfterScrollableAreaChanges) {
   InitializeWithHTML(*WebView()->MainFrameImpl()->GetFrame(),
                      "<style>"

third_party/blink/renderer/core/paint/compositing/paint_layer_compositor.cc

@@ -161,14 +161,6 @@ void PaintLayerCompositor::UpdateInputsIfNeededRecursiveInternal(
   Lifecycle().AdvanceTo(DocumentLifecycle::kCompositingInputsClean);
 
 #if DCHECK_IS_ON()
-  if (!layout_view_->GetDocument()
-           .GetSettings()
-           ->GetAcceleratedCompositingEnabled()) {
-    DCHECK(!layout_view_->GetDocument()
-                .GetSettings()
-                ->GetAcceleratedCompositingEnabled());
-  }
-
   CompositingInputsUpdater::AssertNeedsCompositingInputsUpdateBitsCleared(
       RootLayer());
 #endif
@@ -303,12 +295,8 @@ void PaintLayerCompositor::UpdateAssignmentsIfNeeded(
   CompositingUpdateType update_type = pending_update_type_;
   pending_update_type_ = kCompositingUpdateNone;
 
-  if (!layout_view_->GetDocument()
-           .GetSettings()
-           ->GetAcceleratedCompositingEnabled() ||
-      update_type == kCompositingUpdateNone) {
+  if (update_type == kCompositingUpdateNone)
     return;
-  }
 
   PaintLayer* update_root = RootLayer();