[Blink/SPv175] Fix failure to clear ClipPath effect node

This CL fixes a combination of two bugs that resulted in crash due to
internal inconsistencies. The first bug is that we forgot to clear
ClipPath node when an element lost all of its effect nodes. The second
bug is that the paint property nodes were not invalidated when a SVG
clipPath element was removed.

BUG=818821

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I3e7ba8507c60c4a09f4e88417c76c7e33f1bd1c1
Reviewed-on: https://chromium-review.googlesource.com/959595
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#542728}

third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceClipper.cpp

@@ -267,4 +267,9 @@ FloatRect LayoutSVGResourceClipper::ResourceBoundingBox(
   return transform.MapRect(local_clip_bounds_);
 }
 
+void LayoutSVGResourceClipper::WillBeDestroyed() {
+  MarkAllClientsForInvalidation(kBoundariesInvalidation | kPaintInvalidation);
+  LayoutSVGResourceContainer::WillBeDestroyed();
+}
+
 }  // namespace blink

third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceClipper.h

@@ -62,6 +62,9 @@ class LayoutSVGResourceClipper final : public LayoutSVGResourceContainer {
     in_clip_expansion_ = false;
   }
 
+ protected:
+  void WillBeDestroyed() override;
+
  private:
   void CalculateLocalClipBounds();
 

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

@@ -822,6 +822,7 @@ void FragmentPaintPropertyTreeBuilder::UpdateEffect() {
     } else {
       OnClear(properties_->ClearEffect());
       OnClear(properties_->ClearMask());
+      OnClear(properties_->ClearClipPath());
       OnClearClip(properties_->ClearMaskClip());
     }
   }

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilderTest.cpp

@@ -5243,4 +5243,38 @@ TEST_P(PaintPropertyTreeBuilderTest, SVGRootWithCSSMask) {
   EXPECT_TRUE(root.FirstFragment().PaintProperties()->Mask());
 }
 
+TEST_P(PaintPropertyTreeBuilderTest, ClearClipPathEffectNode) {
+  // This test makes sure ClipPath effect node is cleared properly upon
+  // removal of a clip-path.
+
+  // SPv1 has no effect tree.
+  if (!RuntimeEnabledFeatures::SlimmingPaintV175Enabled())
+    return;
+  SetBodyInnerHTML(R"HTML(
+    <svg>
+      <clipPath clip-path="circle()" id="clip"></clipPath>
+      <rect id="rect" width="800" clip-path="url(#clip)" height="800"/>
+    </svg>
+  )HTML");
+
+  {
+    const auto* rect = GetLayoutObjectByElementId("rect");
+    ASSERT_TRUE(rect);
+    EXPECT_TRUE(rect->FirstFragment().PaintProperties()->MaskClip());
+    EXPECT_TRUE(rect->FirstFragment().PaintProperties()->ClipPath());
+  }
+
+  Element* clip = GetDocument().getElementById("clip");
+  ASSERT_TRUE(clip);
+  clip->remove();
+  GetDocument().View()->UpdateAllLifecyclePhasesExceptPaint();
+
+  {
+    const auto* rect = GetLayoutObjectByElementId("rect");
+    ASSERT_TRUE(rect);
+    EXPECT_FALSE(rect->FirstFragment().PaintProperties()->MaskClip());
+    EXPECT_FALSE(rect->FirstFragment().PaintProperties()->ClipPath());
+  }
+}
+
 }  // namespace blink