This is actually correct, the OnOrientationChange event is dispatched to every local root: https://cs.chromium.org/chromium/src/content/renderer/render_widget.cc?l=1941

So the grandchild will receive the event via a separate message (though it'll be asynchronous, not sure if this matters).

As dcheng@ noted in the meeting today, it sounds like this would matter for nested same-process frames.  lfg@ said he could take a look.  (Thanks!)

Ah, sorry, I misunderstood Daniel's point, I thought he was referencing a A-B-A case.

However, for the A(1)-A(2)-A(3) case, I think the code is also correct:

  HeapVector<Member<LocalFrame>> frames;
  frames.push_back(GetFrame()); // root frame A(1) gets added here to frames[0]
  for (size_t i = 0; i < frames.size(); i++) {
    for (Frame* child = frames[i]->Tree().FirstChild(); child;
         child = child->Tree().NextSibling()) {
      if (child->IsLocalFrame())
        frames.push_back(ToLocalFrame(child)); // A(2) gets added while iterating over A[1]'s children; now frames.size() is bigger. A(2)'s children will be iterated over in the next iteration of the outer for loop, where we add A(3) to the array.
    }
  }

This looks correct to me also.

We probably need something a bit clearer to iterate over just things in the local root. I misread the code. =)

I've retitled the bug accordingly; one (simple) solution is to just use TraverseNext(), but we could consider specializing a LocalFrame version for traversing local roots.

I agree with you, I'll work on improving this interface.

Marking as WontFix. Unsure whether its worth adding this API given there's only a single use-case. WIP CL: https://chromium-review.googlesource.com/c/chromium/src/+/538258