New issue
Advanced search Search tips

Issue 771757 link

Starred by 6 users

Issue metadata

Status: Started
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac
Pri: 2
Type: Bug



Sign in to add a comment

don't dispose FrameView on iframe detach

Project Member Reported by skobes@chromium.org, Oct 4 2017

Issue description

Spinoff of  http://crbug.com/758130#c6 .

When an <iframe> element becomes display:none, the LayoutIFrame is destroyed.  This tells the HTMLIFrameElement to clear its embedded content view, which calls Dispose() on the child FrameView.

  blink::LocalFrameView::Dispose()
  blink::HTMLFrameOwnerElement::SetEmbeddedContentView()
  blink::LayoutEmbeddedContent::WillBeDestroyed()
  blink::LayoutEmbeddedContent::Destroy()
  blink::LayoutObject::DestroyAndCleanupAnonymousWrappers()
  blink::Node::DetachLayoutTree()

This is bad.  The FrameView is retained by the LocalFrame object, which remains in the frame tree.  If the <iframe> is redisplayed in the future, the FrameView gets reused.

One visible consequence is that ScrollAnimator gets recreated with the wrong scroll offset.  There are probably other bugs lurking, because FrameView isn't meant to be reused after Dispose().

Even if the iframe doesn't get redisplayed, we want its FrameView to stay alive.  This is because a display:none iframe has a DOM and can run script.

Today, a display:none iframe also runs full layout.  Even though there's no LayoutIFrame for the <iframe> element, the iframe's Document holds a layout tree for the DOM inside the iframe.

After  issue 650433  (currently behind a REF named "DisplayNoneIFrameCreatesNoLayoutObject"), we will stop creating layout objects for elements inside the iframe's Document.  However, we will still create the layout object for the Document itself (LayoutView).  This REF doesn't affect FrameView lifetime considerations.

A naive fix would simply stop calling SetEmbeddedContentView(nullptr) from LayoutEmbeddedContent::WillBeDestroyed.  When I tried this, it broke some unit tests, including WebFrameSimTest.DisplayNoneIFrameHasNoLayoutObjects.  Need to investigate why.
 
IIRC, WebFrameSimTest.DisplayNoneIFrameHasNoLayoutObjects and the REF relies on SetEmbeddedContentView(nullptr) to trigger the "dispose of children of layout view" logic. We could just plumb this through directly?
Cc: skobes@chromium.org
Owner: bokan@chromium.org
David is looking at this (thanks!)

Comment 3 by dcheng@chromium.org, May 16 2018

Cc: dcheng@chromium.org
Cc: szager@chromium.org
 Issue 626810  has been merged into this issue.

Sign in to add a comment