LibWeb: Detach all paintables when building/committing layout tree

Instead of trying to be clever and detaching the paint tree lazily,
just detach all paintables from both DOM and layout tree when building
and committing respectively.

Userland/Libraries/LibWeb/Layout/LayoutState.cpp

@@ -388,8 +388,8 @@ void LayoutState::commit(Box& root)
     // NOTE: In case this is a relayout of an existing tree, we start by detaching the old paint tree
     //       from the layout tree. This is done to ensure that we don't end up with any old-tree pointers
     //       when text paintables shift around in the tree.
-    root.for_each_in_inclusive_subtree_of_type<Layout::TextNode>([&](Layout::TextNode& text_node) {
-        text_node.set_paintable(nullptr);
+    root.for_each_in_inclusive_subtree([&](Layout::Node& node) {
+        node.set_paintable(nullptr);
         return IterationDecision::Continue;
     });
 

Userland/Libraries/LibWeb/Layout/TreeBuilder.cpp

@@ -296,10 +296,11 @@ ErrorOr<void> TreeBuilder::create_layout_tree(DOM::Node& dom_node, TreeBuilder::
 
     ScopeGuard remove_stale_layout_node_guard = [&] {
         // If we didn't create a layout node for this DOM node,
-        // go through the DOM tree and remove any old layout nodes since they are now all stale.
+        // go through the DOM tree and remove any old layout & paint nodes since they are now all stale.
         if (!layout_node) {
             dom_node.for_each_in_inclusive_subtree([&](auto& node) {
                 node.detach_layout_node({});
+                node.set_paintable(nullptr);
                 if (is<DOM::Element>(node))
                     static_cast<DOM::Element&>(node).clear_pseudo_element_nodes({});
                 return IterationDecision::Continue;