Cherry-pick 098ae9d. rdar://125368853

    Unreviewed, reverting 276494@main.
    https://bugs.webkit.org/show_bug.cgi?id=271720

    Caused a hang exiting fullscreen (<rdar://125368853>)

    Reverted changeset:

    "REGRESSION (UI-side compositing?): Sporadic failures in layout tests due to wrong test images"
    https://bugs.webkit.org/show_bug.cgi?id=271348
    https://commits.webkit.org/276494@main

    Canonical link: https://commits.webkit.org/276706@main

Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm

@@ -1280,16 +1280,26 @@ - (void)takeSnapshotWithConfiguration:(WKSnapshotConfiguration *)snapshotConfigu
         return;
     }
 
-    _page->callAfterNextPresentationUpdateAndLayerCommit([callSnapshotRect = WTFMove(callSnapshotRect), handler, page = Ref { *_page }] () mutable {
+    _page->callAfterNextPresentationUpdate([callSnapshotRect = WTFMove(callSnapshotRect), handler, page = Ref { *_page }] () mutable {
+
         if (!page->hasRunningProcess()) {
             tracePoint(TakeSnapshotEnd, snapshotFailedTraceValue);
             handler(nil, createNSError(WKErrorUnknown).get());
             return;
         }
 
-        dispatch_async(dispatch_get_main_queue(), [callSnapshotRect = WTFMove(callSnapshotRect)] {
-            callSnapshotRect();
-        });
+        // Create an implicit transaction to ensure a commit will happen next.
+        [CATransaction activate];
+
+        // Wait for the next flush to ensure the latest IOSurfaces are pushed to backboardd before taking the snapshot.
+        [CATransaction addCommitHandler:[callSnapshotRect = WTFMove(callSnapshotRect)]() mutable {
+            // callSnapshotRect() calls the client callback which may call directly or indirectly addCommitHandler.
+            // It is prohibited by CA to add a commit handler while processing a registered commit handler.
+            // So postpone calling callSnapshotRect() till CATransaction processes its commit handlers.
+            dispatch_async(dispatch_get_main_queue(), [callSnapshotRect = WTFMove(callSnapshotRect)] {
+                callSnapshotRect();
+            });
+        } forPhase:kCATransactionPhasePostCommit];
     });
 #endif
 }

Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm

@@ -77,7 +77,6 @@
 #import <pal/spi/ios/BrowserEngineKitSPI.h>
 #import <pal/spi/mac/QuarantineSPI.h>
 #import <wtf/BlockPtr.h>
-#import <wtf/CompletionHandler.h>
 #import <wtf/SoftLinking.h>
 #import <wtf/cf/TypeCastsCF.h>
 #import <wtf/cocoa/SpanCocoa.h>
@@ -168,21 +167,6 @@ static bool exceedsRenderTreeSizeSizeThreshold(uint64_t thresholdSize, uint64_t
     protectedPageClient()->layerTreeCommitComplete();
 }
 
-void WebPageProxy::callAfterNextPresentationUpdateAndLayerCommit(CompletionHandler<void()>&& callback)
-{
-    callAfterNextPresentationUpdate([callback = WTFMove(callback)]() mutable {
-        // Create an implicit transaction to ensure a commit will happen next.
-        [CATransaction activate];
-
-        auto completionBlock = makeBlockPtr([callback = WTFMove(callback)]() mutable {
-            callback();
-        });
-
-        // Wait for the next flush to ensure the latest IOSurfaces are pushed to backboardd before taking the snapshot.
-        [CATransaction addCommitHandler:completionBlock.get() forPhase:kCATransactionPhasePostCommit];
-    });
-}
-
 #if ENABLE(DATA_DETECTION)
 
 void WebPageProxy::setDataDetectionResult(const DataDetectionResult& dataDetectionResult)

Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -5695,7 +5695,7 @@ void WebPageProxy::forceRepaint(CompletionHandler<void()>&& callback)
         RefPtr protectedThis = weakThis.get();
         if (!protectedThis)
             return callback();
-        protectedThis->callAfterNextPresentationUpdateAndLayerCommit(WTFMove(callback));
+        protectedThis->callAfterNextPresentationUpdate(WTFMove(callback));
     });
     forEachWebContentProcess([&](auto& webProcess, auto pageID) {
         webProcess.sendWithAsyncReply(Messages::WebPage::ForceRepaint(), [aggregator] { }, pageID);
@@ -11901,13 +11901,6 @@ void WebPageProxy::callAfterNextPresentationUpdate(CompletionHandler<void()>&& c
 }
 #endif
 
-#if !PLATFORM(COCOA)
-void WebPageProxy::callAfterNextPresentationUpdateAndLayerCommit(CompletionHandler<void()>&& callback)
-{
-    return callAfterNextPresentationUpdate(WTFMove(callback));
-}
-#endif
-
 void WebPageProxy::setShouldScaleViewToFitDocument(bool shouldScaleViewToFitDocument)
 {
     if (m_shouldScaleViewToFitDocument == shouldScaleViewToFitDocument)

Source/WebKit/UIProcess/WebPageProxy.h

@@ -1863,7 +1863,6 @@ class WebPageProxy final : public API::ObjectImpl<API::Object::Type::Page>, publ
     // For testing
     void clearWheelEventTestMonitor();
     void callAfterNextPresentationUpdate(CompletionHandler<void()>&&);
-    void callAfterNextPresentationUpdateAndLayerCommit(CompletionHandler<void()>&&);
 
     void didReachLayoutMilestone(OptionSet<WebCore::LayoutMilestone>);