ekramad@ - Could you check and see if this is related to your EventHandlerRegistry refactor?

I can confirm this happens on Android. I did not test it on other platforms however.

First off, I don't think this is related to EHR nor its refactor.

This sounds like a provisional frame issue. Essentially, in ChromeClientImpl::SetEventHandlerProperties we would early return if |frame_| is provisional. This appears to be the case with OOPIF (as opposed to main frame). Also, I think the call comes from FrameLoader::CommitProvisionalLoad.

Perhaps we need to send the update as soon as the frame has a WebFrameWidget?

So apparently RemoteFrameOwner::SetContentFrame is called after all the attempts to SetEventListenerProperties. This means the LocalRoot is sitting out as provisional during this time.

Xida and I talked offline and the question is if the ChromeClientImpl::SetEventListener... call is even necessary at this stage of loading. The browser side state is already "false" and I suspect (but not sure) at this stage tree_view->EventListenerProperties(...) == kNothing.

cc-ing flackr@ for some input on this.

Taking a second look at this, sending the update seems like the easiest fix (as opposed to initializing the corresponding state in CC and browser. Essentially, things like |allowed_touch_action_| are optional and rely on renderer updates so it makes more sense to change them through that and that only.

I have a CL in progress: https://chromium-review.googlesource.com/c/chromium/src/+/1126329

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8afd07cc1159e077da359175edefd419a090fb7d

commit 8afd07cc1159e077da359175edefd419a090fb7d
Author: Ehsan Karamad <ekaramad@chromium.org>
Date: Thu Jul 12 20:25:25 2018

Reset listener properties after provisional load

When provisional load is committed in FrameLoader and the corresponding
frame is a LocalRoot, the EventListenerProperties are reset to none for
touch and wheel listeners. This update is then propagate through render
widget and LayterTreeHost to the browser and the CC correspondingly.

However, if the local root is provisional the call is dropped in
ChromeClientImpl. This would include all cross-process navigations which
end up in a provisional frame.

This change will make sure the initial updates for
EventListenerProperties for a local root are sent after
WebLocalFrameClient is notified about committing provisional load.

Bug:  850994 
Change-Id: I686ab51277bf675d93bd744d6d0208977ac06b5c
Reviewed-on: https://chromium-review.googlesource.com/1126329
Commit-Queue: Ehsan Karamad <ekaramad@google.com>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#574701}
[modify] https://crrev.com/8afd07cc1159e077da359175edefd419a090fb7d/content/browser/renderer_host/input/input_router_impl.h
[modify] https://crrev.com/8afd07cc1159e077da359175edefd419a090fb7d/content/browser/renderer_host/render_widget_host_browsertest.cc
[modify] https://crrev.com/8afd07cc1159e077da359175edefd419a090fb7d/third_party/blink/renderer/core/exported/local_frame_client_impl.cc
[modify] https://crrev.com/8afd07cc1159e077da359175edefd419a090fb7d/third_party/blink/renderer/core/loader/frame_loader.cc

The fix in comment #9 should fix the issue. Closing the bug.