[mapToVisualRectInAncestorSpace] Check for detached iframes.

third_party/WebKit/Source/core/layout/LayoutView.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 459 matching lines @@
             rect.moveBy(-viewRectangle.location());
         }
         // Frames are painted at rounded-int position. Since we cannot efficiently compute the subpixel offset
         // of painting at this point in a a bottom-up walk, round to the enclosing int rect, which will enclose
         // the actual visible rect.
         rect = LayoutRect(enclosingIntRect(rect));
 
         // Adjust for frame border.
         rect.move(obj->contentBoxOffset());
         return obj->mapToVisualRectInAncestorSpace(ancestor, rect, visualRectFlags);
+        return true;
     }
 
-    return true;
+    // This can happen, e.g., if the iframe element has display:none.
+    rect = LayoutRect();
+    return false;
 }
 
 void LayoutView::adjustOffsetForFixedPosition(LayoutRect& rect) const
 {
     if (m_frameView) {
         rect.move(LayoutSize(m_frameView->scrollOffset()));
         if (hasOverflowClip())
             rect.move(scrolledContentOffset());
 
         // FIXME: Paint invalidation should happen after scroll updates, so there should be no pending scroll delta.
@@ skipping 499 matching lines @@
     // of this override. All frame scrolling should be handled by
     // ViewportScrollCallback.
 
     if (!frameView())
         return ScrollResult(false, false, delta.width(), delta.height());
 
     return frameView()->getScrollableArea()->userScroll(granularity, delta);
 }
 
 } // namespace blink