The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6fe326cd80cd13676bbb45ba47bb5c9754989bfe

commit 6fe326cd80cd13676bbb45ba47bb5c9754989bfe
Author: Rune Lillesveen <futhark@chromium.org>
Date: Mon May 28 12:54:04 2018

[Squad] Load input type=image on style recalc.

That way we would not have to re-attach the layout tree inside layout
tree rebuilding when image resources finish loading immediately.

TEST=fast/forms/image/fallback-reattach-crash.html

Bug:  843520 ,  845167 
Change-Id: I37e6121e30b8909dd5df4483f2109d5e1e02945c
Reviewed-on: https://chromium-review.googlesource.com/1072650
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#562239}
[modify] https://crrev.com/6fe326cd80cd13676bbb45ba47bb5c9754989bfe/third_party/blink/renderer/core/html/forms/html_input_element.cc
[modify] https://crrev.com/6fe326cd80cd13676bbb45ba47bb5c9754989bfe/third_party/blink/renderer/core/html/forms/html_input_element.h
[modify] https://crrev.com/6fe326cd80cd13676bbb45ba47bb5c9754989bfe/third_party/blink/renderer/core/html/forms/image_input_type.cc
[modify] https://crrev.com/6fe326cd80cd13676bbb45ba47bb5c9754989bfe/third_party/blink/renderer/core/html/forms/image_input_type.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f5b29d04b62d0f95e373dac8fb263b3148d19d9a

commit f5b29d04b62d0f95e373dac8fb263b3148d19d9a
Author: Rune Lillesveen <futhark@chromium.org>
Date: Tue May 29 05:07:59 2018

[Squad] Trigger image loading on style recalc for plugins.

This is done to avoid re-attaching fallback content as part of building
the layout tree. That meant we had to recalculate style twice, the
second time inside LayoutTreeBuilderForElement::Style().

TEST=http/tests/misc/object-image-error.html

Bug:  843520 ,  845167 

Change-Id: I5ad8d0f5d82a6ef0437d6ef5e1e015f5e1575faa
Reviewed-on: https://chromium-review.googlesource.com/1073421
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#562341}
[modify] https://crrev.com/f5b29d04b62d0f95e373dac8fb263b3148d19d9a/third_party/blink/renderer/core/html/html_object_element.cc
[modify] https://crrev.com/f5b29d04b62d0f95e373dac8fb263b3148d19d9a/third_party/blink/renderer/core/html/html_plugin_element.cc
[modify] https://crrev.com/f5b29d04b62d0f95e373dac8fb263b3148d19d9a/third_party/blink/renderer/core/html/html_plugin_element.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/810bb17f22970b02ca6f050afaf9a2c8bcb5beb3

commit 810bb17f22970b02ca6f050afaf9a2c8bcb5beb3
Author: Rune Lillesveen <futhark@chromium.org>
Date: Wed May 30 05:25:44 2018

[Squad] SetLayoutDisposition() not called during style update.

I have not been able to find a situation where we would call
SetLayoutDisposition() during style or layout tree update. Replacing the
synchronous re-attach code with a DCHECK.

Bug:  843520 ,  845167 
Change-Id: Ibf1e8a02d0e905522e4006be078b047b6a856b8a
Reviewed-on: https://chromium-review.googlesource.com/1076027
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#562742}
[modify] https://crrev.com/810bb17f22970b02ca6f050afaf9a2c8bcb5beb3/third_party/blink/renderer/core/html/html_image_element.cc