isFlexibleBox seems like a perfect example for devirtualization as it has two overrides:

LayoutObject:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/layout/LayoutObject.h?cl=GROK&gsn=isChildAllowed&rcl=1471276009&l=1214

virtual bool isFlexibleBox() const { return false; }

and

LayoutFlexibleBox:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h?cl=GROK&gsn=isChildAllowed&rcl=1471276009&l=49

bool isFlexibleBox() const final { return true; }

For some reason this method is not in the list of devirtualized methods:
https://storage.googleapis.com/cfi-stats/2016-08-15/devirt-methods.html

This looks like a bug to be fixed.