Fix stop node and lifecycle handling for cross-frame hit test.

Previously, when EventHandler propagated the hit test up to the local
root frame, it failed to propagate the no_lifecycle_update flag, which
inadvertently triggered a lifecycle update (causing DCHECK failures in
some cases).

Also, when the hit test code traversed into a child document inside an
iframe, it didn't propagate the stop_node field from the original hit
test request, so the hit test inside the iframe didn't honor the stop
node.

BUG=827639
R=chrishtr@chromium.org

Change-Id: Ib29f26e41b945b53db6e427d41a03742af0ee4db
Reviewed-on: https://chromium-review.googlesource.com/1167746Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Commit-Queue: Stefan Zager <szager@chromium.org>
Cr-Commit-Position: refs/heads/master@{#581781}

third_party/blink/renderer/core/input/event_handler.cc

@@ -287,12 +287,12 @@ HitTestResult EventHandler::HitTestResultAtLocation(
           HitTestLocation adjusted_location(
               (LayoutRect(main_content_point, location.BoundingBox().Size())));
           return main_frame.GetEventHandler().HitTestResultAtLocation(
-              adjusted_location, hit_type, stop_node);
+              adjusted_location, hit_type, stop_node, no_lifecycle_update);
         } else {
           HitTestLocation adjusted_location(main_view->ConvertFromRootFrame(
               frame_view->ConvertToRootFrame(location.Point())));
           return main_frame.GetEventHandler().HitTestResultAtLocation(
-              adjusted_location, hit_type, stop_node);
+              adjusted_location, hit_type, stop_node, no_lifecycle_update);
         }
       }
     }

third_party/blink/renderer/core/layout/layout_embedded_content.cc

@@ -198,8 +198,10 @@ bool LayoutEmbeddedContent::NodeAtPoint(
           LayoutPoint(BorderLeft() + PaddingLeft(), BorderTop() + PaddingTop());
       HitTestLocation new_hit_test_location(
           location_in_container, -adjusted_location - content_offset);
-      HitTestRequest new_hit_test_request(result.GetHitTestRequest().GetType() |
-                                          HitTestRequest::kChildFrameHitTest);
+      HitTestRequest new_hit_test_request(
+          result.GetHitTestRequest().GetType() |
+              HitTestRequest::kChildFrameHitTest,
+          result.GetHitTestRequest().GetStopNode());
       HitTestResult child_frame_result(new_hit_test_request,
                                        new_hit_test_location);
 

third_party/blink/renderer/core/layout/layout_object_test.cc

@@ -847,4 +847,34 @@ TEST_F(LayoutObjectSimTest, TouchActionUpdatesSubframeEventHandler) {
   EXPECT_FALSE(DocumentHasTouchActionRegion(registry));
 }
 
+TEST_F(LayoutObjectSimTest, HitTestForOcclusionInIframe) {
+  SimRequest main_resource("https://example.com/test.html", "text/html");
+  SimRequest frame_resource("https://example.com/frame.html", "text/html");
+
+  LoadURL("https://example.com/test.html");
+  main_resource.Complete(R"HTML(
+    <iframe style='width:300px;height:150px;' src=frame.html></iframe>
+    <div id='occluder' style='will-change:transform;width:100px;height:100px;'>
+    </div>
+  )HTML");
+  frame_resource.Complete(R"HTML(
+    <div id='target'>target</div>
+  )HTML");
+
+  GetDocument().View()->UpdateAllLifecyclePhases();
+  Element* iframe_element = GetDocument().QuerySelector("iframe");
+  HTMLFrameOwnerElement* frame_owner_element =
+      ToHTMLFrameOwnerElement(iframe_element);
+  Document* iframe_doc = frame_owner_element->contentDocument();
+  Element* target = iframe_doc->getElementById("target");
+  HitTestResult result = target->GetLayoutObject()->HitTestForOcclusion();
+  EXPECT_TRUE(result.InnerNode() == target);
+
+  Element* occluder = GetDocument().getElementById("occluder");
+  occluder->SetInlineStyleProperty(CSSPropertyMarginTop, "-150px");
+  GetDocument().View()->UpdateAllLifecyclePhases();
+  result = target->GetLayoutObject()->HitTestForOcclusion();
+  EXPECT_TRUE(result.InnerNode() == occluder);
+}
+
 }  // namespace blink