Reported as part of https://bugs.chromium.org/p/chromium/issues/detail?id=859294

wangxianzhu@ says:

The root cause is mismatching hierarchies of PaintLayer and compositing. 
The DOM tree is like:
  <svg style="backface-visibility: hidden">
    <foreignObject>
      some inline boxes
    </foreignObject>
  </svg>

In the PaintLayer tree, the layers for the svg root and the foreign object are siblings:
 layer for HTML
  normal flow list
   layer for the svg
  positive z-order list
   layer for the foreignObject
while in the GraphicsLayer tree, the foreignObject is painted on the GraphicsLayer of the svg.

When the contents of the foreignObject changes, we mark the painting layer ancestors for NeedsRepaint, and miss the svg which is not in the painting layer ancestor path. In the next paint, the svg's GraphicsLayer is repainted. Then during FinishCycle() when we iterate the DisplayItemClients we access some deleted DisplayItemClients under the foreignObject.

I can change GraphicsLayer to call FinishCycle() for real repainted layers only to avoid the heap-use-after-free for the test case. That won't fix the under-invalidation though.

chrishtr@ can you look into the under-invalidation issue?