We are receiving crash reports of a NPE in blink::PaintArtifactCompositor::LayerizeGroup:
blink::PaintPropertyNode<blink::ClipPaintPropertyNode>::Unalias() const
blink::PaintArtifactCompositor::LayerizeGroup(blink::PaintArtifact const&, blink::PaintArtifactCompositor::Settings const&, WTF::Vector<blink::PaintArtifactCompositor::PendingLayer, 0u, WTF::PartitionAllocator>&, blink::EffectPaintPropertyNode const&, blink::PaintChunk const*&)
blink::PaintArtifactCompositor::LayerizeGroup(blink::PaintArtifact const&, blink::PaintArtifactCompositor::Settings const&, WTF::Vector<blink::PaintArtifactCompositor::PendingLayer, 0u, WTF::PartitionAllocator>&, blink::EffectPaintPropertyNode const&, blink::PaintChunk const*&)
blink::PaintArtifactCompositor::Update(scoped_refptr<blink::PaintArtifact const>, std::__ndk1::unordered_set<cc::ElementId, cc::ElementIdHash, std::__ndk1::equal_to<cc::ElementId>, std::__ndk1::allocator<cc::ElementId> >&, blink::PaintArtifactCompositor::ViewportProperties const&, blink::PaintArtifactCompositor::Settings const&)
blink::LocalFrameView::UpdateLifecyclePhases(blink::DocumentLifecycle::LifecycleState, blink::DocumentLifecycle::LifecycleUpdateReason)
(see: go/crash/a910bda95821e273)

Looking at PaintArtifactCompositor::LayerizeGroup, the only calls to ClipNode::Unalias seem to be from CanUpcastTo. Maybe we could put in some speculative CHECKS that the ClipNodes are non-null? We could also add a speculative "return false" for those conditions.

Vlad, do you have cycles to take a look at this? I don't think this is related to your work on aliasing; I think it's just a general paint bug.