Don't create layout objects for children of display-none iframes.

third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp b/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp
index cebcc0b20d7aba39bb64b8c0c9697deed0f4a954..8e9757fc9e54137bca41afe801c7c45c4abd4b67 100644
--- a/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp
@@ -221,6 +221,13 @@ void HTMLFrameOwnerElement::disposeWidgetSoon(Widget* widget) {
   widget->dispose();
 }
 
+void HTMLFrameOwnerElement::frameOwnerPropertiesChanged() {
+  // Don't notify about updates if contentFrame() is null, for example when
+  // the subframe hasn't been created yet.
+  if (contentFrame())
+    document().frame()->loader().client()->didChangeFrameOwnerProperties(this);
+}
+
 void HTMLFrameOwnerElement::dispatchLoad() {
   dispatchScopedEvent(Event::create(EventTypeNames::load));
 }
@@ -243,6 +250,16 @@ void HTMLFrameOwnerElement::setWidget(Widget* widget) {
   if (widget == m_widget)
     return;
 
+  Document* doc = contentDocument();

[dcheng, 2016/12/15 21:35:04]

I feel like setWidget() is a less typical choice to hook for determining
visibility.

An alternative is to override attachLayoutTree / detachLayoutTree, which is
directly related to whether or not this thing has a layout object.

esprehn, WDYT?

[esprehn, 2016/12/15 21:45:56]

Since we already have all of this machinery, and setWidget is what powers the
show() and hide() notifications on the FrameView (for display: none and
visibility hidden) this seemed like a reasonable place for it.

At first I didn't suggest attach/detach because of complexity about reattach,
but this is actually not bad because if an iframe is removed from the DOM we
destroy the layout tree when we do Document::shutdown so we don't need to handle
detach at all, just attach (all style changes will be a pair of detach/attach,
we only get unpaired detach when lazyReattaching, where style will run attach
later, or when removing nodes from the dom).

This pseudo code should work:

void attachLayoutObject(context) {
  bool hasLayoutObject = static_cast<bool>(layoutObject());
  super(context);
  if (hasLayoutObject != static_cast<bool>(layoutObject()))
    notifyDisplayNoneChanged();
}

+  if (doc && doc->frame()) {

[dcheng, 2016/12/15 21:35:04]

I don't think it's possible to have a contentDocument() with no frame (since
that would imply it's not attached)

[erikchen, 2016/12/16 20:56:12]

This happens on creation. Attached a partial stack trace that gets emitted
during the crash if this conditional is missing.
"""
4   libblink_core.dylib                 0x0000000114a92ddd
_ZN5blink8Document30willChangeFrameOwnerPropertiesEiiNS_13ScrollbarModeEb + 317
5   libblink_core.dylib                 0x0000000115177a82
_ZN5blink21HTMLFrameOwnerElement9setWidgetEPNS_6WidgetE + 370
6   libblink_core.dylib                 0x000000011506833f
_ZN5blink10LocalFrame10createViewERKNS_7IntSizeERKNS_5ColorEbNS_13ScrollbarModeEbS7_b
+ 623
7   libblink_web.dylib                  0x000000011017b7b8
_ZN5blink17WebLocalFrameImpl15createFrameViewEv + 920
8   libblink_web.dylib                  0x0000000110051ff1
_ZN5blink21FrameLoaderClientImpl31transitionToCommittedForNewPageEv + 33
9   libblink_core.dylib                 0x0000000115a452b0
_ZN5blink11FrameLoader21commitProvisionalLoadEv + 784
"""

+    bool isDisplayNone = this->isDisplayNone();
+    bool willBeDisplayNone = !widget;
+    if (isDisplayNone != willBeDisplayNone) {
+      doc->willChangeFrameOwnerProperties(marginWidth(), marginHeight(),
+                                          scrollingMode(), willBeDisplayNone);
+    }
+  }
+
   if (m_widget) {
     if (m_widget->parent())
       moveWidgetToParentSoon(m_widget.get(), 0);
@@ -250,6 +267,7 @@ void HTMLFrameOwnerElement::setWidget(Widget* widget) {
   }
 
   m_widget = widget;
+  frameOwnerPropertiesChanged();
 
   LayoutPart* layoutPart = toLayoutPart(layoutObject());
   LayoutPartItem layoutPartItem = LayoutPartItem(layoutPart);