[Reland #1] Don't create layout objects for children of display-none iframes.

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 2450 matching lines @@
   FrameNavigationDisabler navigationDisabler(*m_frame);
   // Defer FrameViewBase updates to avoid plugins trying to run script inside
   // ScriptForbiddenScope, which will crash the renderer after
   // https://crrev.com/200984
   HTMLFrameOwnerElement::UpdateSuspendScope
       suspendFrameViewBaseHierarchyUpdates;
   // Don't allow script to run in the middle of detachLayoutTree() because a
   // detaching Document is not in a consistent state.
   ScriptForbiddenScope forbidScript;
 
+  m_lifecycle.advanceTo(DocumentLifecycle::Stopping);
   view()->dispose();
 
   // If the FrameViewBase of the document's frame owner doesn't match view()
   // then FrameView::dispose() didn't clear the owner's FrameViewBase. If we
   // don't clear it here, it may be clobbered later in LocalFrame::createView().
   // See also https://crbug.com/673170 and the comment in FrameView::dispose().
   HTMLFrameOwnerElement* ownerElement = m_frame->deprecatedLocalOwner();
   if (ownerElement)
     ownerElement->setWidget(nullptr);
 
   m_markers->prepareForDestruction();
 
-  m_lifecycle.advanceTo(DocumentLifecycle::Stopping);
-
   if (page())
     page()->documentDetached(this);
   probe::documentDetached(this);
 
   if (m_frame->loader().client()->sharedWorkerRepositoryClient())
     m_frame->loader()
         .client()
         ->sharedWorkerRepositoryClient()
         ->documentDetached(this);
 
@@ skipping 2062 matching lines @@
 HTMLFrameOwnerElement* Document::localOwner() const {
   if (!frame())
     return 0;
   // FIXME: This probably breaks the attempts to layout after a load is finished
   // in implicitClose(), and probably tons of other things...
   return frame()->deprecatedLocalOwner();
 }
 
 void Document::willChangeFrameOwnerProperties(int marginWidth,
                                               int marginHeight,
-                                              ScrollbarMode scrollingMode) {
+                                              ScrollbarMode scrollingMode,
+                                              bool isDisplayNone) {
+  DCHECK(frame() && frame()->owner());
+  FrameOwner* owner = frame()->owner();
+
+  if (documentElement()) {
+    if (isDisplayNone != owner->isDisplayNone()) {
+      if (m_lifecycle.state() < DocumentLifecycle::Stopping)

[esprehn, 2017/03/28 21:49:24]

remove this, lazyReattachIfAttached() checks inActiveDocument() which already
checks this for you.

In general explicit checks on the lifecycle are frowned upon, isActive() is
better.

[erikchen, 2017/03/29 20:16:54]

Done.

+        documentElement()->lazyReattachIfAttached();
+    }
+  }
+
   if (!body())
     return;
 
-  DCHECK(frame() && frame()->owner());
-  FrameOwner* owner = frame()->owner();
-
   if (marginWidth != owner->marginWidth())
     body()->setIntegralAttribute(marginwidthAttr, marginWidth);
   if (marginHeight != owner->marginHeight())
     body()->setIntegralAttribute(marginheightAttr, marginHeight);
   if (scrollingMode != owner->scrollingMode() && view())
     view()->setNeedsLayout();
 }
 
 bool Document::isInInvisibleSubframe() const {
   if (!localOwner())
@@ skipping 2094 matching lines @@
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (blink::Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif