Other potential suspects:
https://codereview.chromium.org/2694743004
https://codereview.chromium.org/2655023003
https://codereview.chromium.org/2692233004

but https://codereview.chromium.org/2564633002 (r450748) is the most suspicious because it is huge and changes document / frame ownership logic.

Failing tests in webkit_tests:
http/tests/security/contentSecurityPolicy/object-src-url-allowed.html
virtual/mojo-loading/http/tests/security/contentSecurityPolicy/object-src-none-allowed.html
fast/frames/sandboxed-iframe-plugins.html
http/tests/security/contentSecurityPolicy/object-src-does-not-affect-child.html
virtual/mojo-loading/http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-01.html
http/tests/security/contentSecurityPolicy/1.1/plugintypes-affects-cross-site-child-allowed.html
http/tests/security/mixedContent/insecure-plugin-in-iframe.html
virtual/mojo-loading/http/tests/security/contentSecurityPolicy/object-src-url-allowed.html
plugins/plugin-document-back-forward.html
virtual/mojo-loading/http/tests/security/mixedContent/empty-url-plugin-in-frame.html
fast/frames/sandboxed-iframe-navigation-allowed.html
virtual/mojo-loading/http/tests/security/xssAuditor/object-src-inject.html
http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid.html
http/tests/security/contentSecurityPolicy/object-src-none-allowed.html
virtual/mojo-loading/http/tests/security/contentSecurityPolicy/object-src-does-not-affect-child.html
plugins/iframe-plugin-bgcolor.html
http/tests/plugins/cross-frame-object-access.html
http/tests/security/mixedContent/empty-url-plugin-in-frame.html
http/tests/security/xssAuditor/object-src-inject.html
virtual/mojo-loading/http/tests/security/mixedContent/insecure-plugin-in-iframe.html
plugins/plugin-remove-subframe.html
virtual/mojo-loading/http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid.html
plugins/mouse-move-over-plugin-in-frame.html
plugins/sequential-focus.html
http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-01.html
fast/frames/iframe-plugin-load-remove-document-crash.html
virtual/mojo-loading/http/tests/security/contentSecurityPolicy/1.1/plugintypes-affects-cross-site-child-allowed.html
virtual/mojo-loading/http/tests/plugins/cross-frame-object-access.html

Example failure:
12:02:29.163 31665 [21940/48425] http/tests/security/contentSecurityPolicy/1.1/plugintypes-affects-cross-site-child-allowed.html failed unexpectedly (leak detected: ({"numberOfLiveDocuments":[1,2],"numberOfLiveNodes":[4,10],"numberOfLiveSuspendableObjects":[2,3]}))
12:02:29.147 31766 worker/0 http/tests/security/contentSecurityPolicy/1.1/plugintypes-affects-cross-site-child-allowed.html failed:
12:02:29.147 31766 worker/0  leak detected: ({"numberOfLiveDocuments":[1,2],"numberOfLiveNodes":[4,10],"numberOfLiveSuspendableObjects":[2,3]})

(All of the above .html files fail in a similar way.)

Speculative revert landed:

Revert of Don't create layout objects for children of display-none iframes. (patchset #31 id:650001 of https://codereview.chromium.org/2564633002/ )

Reason for revert:
Suspect for webkit_tests leak failures ( https://crbug.com/692872 ).

See bug for details.

Original issue's description:
> Don't create layout objects for children of display-none iframes.
> 
> Most of this CL is plumbing for FrameOwnerProperties. Interesting changes:
>   * LayoutView can no longer have children if its FrameOwner is "DisplayNone".
>   * A local frame is "DisplayNone" if and only if it has no widget [which should
>     correspond to the actual display:none style].
>   * The DisplayNone property is propagated to remote frames via
>     FrameOwnerProperties.
> 
> Spec discussion: https://github.com/whatwg/html/issues/1813
> 
> BUG= 650433 
> CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_site_isolation
> 
> Review-Url: https://codereview.chromium.org/2564633002
> Cr-Commit-Position: refs/heads/master@{#450748}
> Committed: https://chromium.googlesource.com/chromium/src/+/962434d34e2c9bcd17488f499515920c298b5395

TBR=esprehn@chromium.org,dcheng@chromium.org,avi@chromium.org,erikchen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 650433 
Review-Url: https://codereview.chromium.org/2696283003
Cr-Commit-Position: refs/heads/master@{#450855}
Committed: https://chromium.googlesource.com/chromium/src/+/d8b91eaadcd63c7ece9def5ed795b99256c8188a

This revert fixed the failures.

Good luck, Erik. You can review the failure logs here:
https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20Trusty%20Leak/builds/2290/steps/webkit_tests