The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/32483f98da31dad8739aba1f20ca8d37d34d7449

commit 32483f98da31dad8739aba1f20ca8d37d34d7449
Author: wangxianzhu <wangxianzhu@chromium.org>
Date: Tue Dec 06 18:51:53 2016

[ Pass Crash ] for virtual/spinvalidation/paint/invalidation/animated-gif-transformed-offscreen.html

BUG= 671695 
TBR=wangxianzhu@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2559543002
Cr-Commit-Position: refs/heads/master@{#436663}

[modify] https://crrev.com/32483f98da31dad8739aba1f20ca8d37d34d7449/third_party/WebKit/LayoutTests/TestExpectations

I can't reproduce the crash locally. Ran run-webkit-tests and content_shell directly with the flags, repeated many times. Tried debug and release with dcheck.

@pdr can you reproduce?

I actually was able to reproduce locally with:
rtd virtual/spinvalidation/paint/invalidation/animated-gif-transformed-offscreen.html --iterations=100

It crashed once in 100 iterations, so it's very rare. Possibly increasing to 1000 will make it repro for you?

In the test I see we disable underinvalidation checking because it is intentional for offscreen gifs. I wonder if we just need similar logic for spv2?

--iterations=100 worked for me. What I said "many times" was just ten times manually.

Under-invalidation checking is disabled because we intentionally not to invalidate and repaint the offscreen animated gif when its image changed. The crash is about changed transform property which seems not the case that the offscreen image changed. Looking into the crash with more logs added.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d76ff3eba94442beb49b45c1bdc7abca39117a91

commit d76ff3eba94442beb49b45c1bdc7abca39117a91
Author: wangxianzhu <wangxianzhu@chromium.org>
Date: Wed Dec 07 01:30:35 2016

[SPInvalidation] Invalidate paint property when transform etc. change

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
BUG= 671695 
TEST=virtual/spinvalidation/paint/invalidation/animated-gif-transformed-offscreen.html (repeat many times)

Review-Url: https://codereview.chromium.org/2556803004
Cr-Commit-Position: refs/heads/master@{#436822}

[modify] https://crrev.com/d76ff3eba94442beb49b45c1bdc7abca39117a91/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/d76ff3eba94442beb49b45c1bdc7abca39117a91/third_party/WebKit/Source/core/layout/LayoutObject.cpp