LibWeb: Save ScrollState snapshot in DisplayList to avoid race condition

With this change we save a copy of of scroll state at the time of
recording a display list, instead of actual ScrollState pointer that
could be modifed by the main thread while display list is beings
rasterized on the rendering thread, which leads to a frame painted with
inconsistent scroll state.

Fixes https://github.com/LadybirdBrowser/ladybird/issues/4288

Libraries/LibWeb/HTML/RenderingThread.cpp

@@ -57,17 +57,17 @@ void RenderingThread::rendering_thread_loop()
         }
 
         auto painting_surface = painting_surface_for_backing_store(task->backing_store);
-        m_skia_player->execute(*task->display_list, painting_surface);
+        m_skia_player->execute(*task->display_list, task->scroll_state_snapshot, painting_surface);
         m_main_thread_event_loop.deferred_invoke([callback = move(task->callback)] {
             callback();
         });
     }
 }
 
-void RenderingThread::enqueue_rendering_task(NonnullRefPtr<Painting::DisplayList> display_list, NonnullRefPtr<Painting::BackingStore> backing_store, Function<void()>&& callback)
+void RenderingThread::enqueue_rendering_task(NonnullRefPtr<Painting::DisplayList> display_list, Painting::ScrollStateSnapshot&& scroll_state_snapshot, NonnullRefPtr<Painting::BackingStore> backing_store, Function<void()>&& callback)
 {
     Threading::MutexLocker const locker { m_rendering_task_mutex };
-    m_rendering_tasks.enqueue(Task { move(display_list), move(backing_store), move(callback) });
+    m_rendering_tasks.enqueue(Task { move(display_list), move(scroll_state_snapshot), move(backing_store), move(callback) });
     m_rendering_task_ready_wake_condition.signal();
 }
 

Libraries/LibWeb/HTML/RenderingThread.h

@@ -28,7 +28,7 @@ public:
     void start(DisplayListPlayerType);
     void set_skia_player(OwnPtr<Painting::DisplayListPlayerSkia>&& player) { m_skia_player = move(player); }
     void set_skia_backend_context(RefPtr<Gfx::SkiaBackendContext> context) { m_skia_backend_context = move(context); }
-    void enqueue_rendering_task(NonnullRefPtr<Painting::DisplayList>, NonnullRefPtr<Painting::BackingStore>, Function<void()>&& callback);
+    void enqueue_rendering_task(NonnullRefPtr<Painting::DisplayList>, Painting::ScrollStateSnapshot&&, NonnullRefPtr<Painting::BackingStore>, Function<void()>&& callback);
     void clear_bitmap_to_surface_cache();
 
 private:
@@ -46,6 +46,7 @@ private:
 
     struct Task {
         NonnullRefPtr<Painting::DisplayList> display_list;
+        Painting::ScrollStateSnapshot scroll_state_snapshot;
         NonnullRefPtr<Painting::BackingStore> backing_store;
         Function<void()> callback;
     };

Libraries/LibWeb/HTML/TraversableNavigable.cpp

@@ -1426,7 +1426,8 @@ RefPtr<Painting::DisplayList> TraversableNavigable::record_display_list(DevicePi
 
 void TraversableNavigable::start_display_list_rendering(NonnullRefPtr<Painting::DisplayList> display_list, NonnullRefPtr<Painting::BackingStore> backing_store, Function<void()>&& callback)
 {
-    m_rendering_thread.enqueue_rendering_task(move(display_list), move(backing_store), move(callback));
+    auto scroll_state_snapshot = active_document()->paintable()->scroll_state().snapshot();
+    m_rendering_thread.enqueue_rendering_task(move(display_list), move(scroll_state_snapshot), move(backing_store), move(callback));
 }
 
 }