Forbid script execution while updating the paint lifecycle.

(cherry picked from commit 5425d3b)

Bug: 1196781
Change-Id: Idc8d24792d5c413691977b09ca821de4e13887ad
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2812000
Commit-Queue: Adrian Taylor <adetaylor@chromium.org>
Commit-Queue: Robert Flack <flackr@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#870275}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2812420
Reviewed-by: Prudhvi Kumar Bommana <pbommana@google.com>
Reviewed-by: Adrian Taylor <adetaylor@chromium.org>
Reviewed-by: Krishna Govind <govind@chromium.org>
Commit-Queue: Krishna Govind <govind@chromium.org>
Owners-Override: Krishna Govind <govind@chromium.org>
Auto-Submit: Krishna Govind <govind@chromium.org>
Cr-Commit-Position: refs/branch-heads/4469@{#10}
Cr-Branched-From: 8563c4c-refs/heads/master@{#869727}

third_party/blink/renderer/core/frame/local_frame_view.cc

@@ -2924,11 +2924,17 @@ void LocalFrameView::RunPaintLifecyclePhase(PaintBenchmarkMode benchmark_mode) {
           for (PaintLayerScrollableArea* area : *animating_scrollable_areas)
             area->UpdateCompositorScrollAnimations();
         }
-        frame_view.GetLayoutView()
-            ->GetDocument()
-            .GetDocumentAnimations()
-            .UpdateAnimations(DocumentLifecycle::kPaintClean,
-                              paint_artifact_compositor_.get());
+        {
+          // Updating animations can notify ready promises which could mutate
+          // the DOM. We should delay these until we have finished the lifecycle
+          // update. https://crbug.com/1196781
+          ScriptForbiddenScope forbid_script;
+          frame_view.GetLayoutView()
+              ->GetDocument()
+              .GetDocumentAnimations()
+              .UpdateAnimations(DocumentLifecycle::kPaintClean,
+                                paint_artifact_compositor_.get());
+        }
         Document& document = frame_view.GetLayoutView()->GetDocument();
         total_animations_count +=
             document.GetDocumentAnimations().GetAnimationsCount();