UpdateStyleAndLayoutTree before opening InternalPopupMenu.

InternalPopupMenu ensures the ComputedStyle of some elements, via
InternalPopupMenu::AddElementStyle, HTMLSelectElement::ItemComputedStyle.
This hits a DHCECK in Element::EnsureComputedStyle, because the tree is
apparently not style-clean at that time.

R=fergal@chromium.org

Bug: 934035
Change-Id: I7c48690d06484c6bbce4e2dad952e2edd73fa231
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1482891
Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#637653}

third_party/blink/renderer/core/BUILD.gn

@@ -1944,6 +1944,7 @@ jumbo_source_set("unit_tests") {
     "html/forms/html_output_element_test.cc",
     "html/forms/html_select_element_test.cc",
     "html/forms/html_text_area_element_test.cc",
+    "html/forms/internal_popup_menu_test.cc",
     "html/forms/option_list_test.cc",
     "html/forms/password_input_type_test.cc",
     "html/forms/step_range_test.cc",

third_party/blink/renderer/core/html/forms/internal_popup_menu.cc

@@ -231,6 +231,10 @@ void InternalPopupMenu::Trace(Visitor* visitor) {
 
 void InternalPopupMenu::WriteDocument(SharedBuffer* data) {
   HTMLSelectElement& owner_element = *owner_element_;
+  // When writing the document, we ensure the ComputedStyle of the select
+  // element's items (see AddElementStyle). This requires a style-clean tree.
+  // See Element::EnsureComputedStyle for further explanation.
+  owner_element.GetDocument().UpdateStyleAndLayoutTree();
   IntRect anchor_rect_in_screen = chrome_client_->ViewportToScreen(
       owner_element.VisibleBoundsInVisualViewport(),
       owner_element.GetDocument().View());

third_party/blink/renderer/core/html/forms/internal_popup_menu_test.cc

+// Copyright (c) 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/html/forms/internal_popup_menu.h"
+
+#include "build/build_config.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/dom/element.h"
+#include "third_party/blink/renderer/core/html/forms/html_select_element.h"
+#include "third_party/blink/renderer/core/loader/empty_clients.h"
+#include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+#include "third_party/blink/renderer/platform/shared_buffer.h"
+
+namespace blink {
+
+// InternalPopupMenuTest is not used on Android, and its Platform implementation
+// does not provide the resources (as in GetDataResource) needed by
+// InternalPopupMenu::WriteDocument.
+#if !defined(OS_ANDROID)
+
+TEST(InternalPopupMenuTest, WriteDocumentInStyleDirtyTree) {
+  auto dummy_page_holder_ = DummyPageHolder::Create(IntSize(800, 600));
+  Document& document = dummy_page_holder_->GetDocument();
+  document.body()->SetInnerHTMLFromString(R"HTML(
+    <select id="select">
+        <option value="foo">Foo</option>
+        <option value="bar" style="display:none">Bar</option>
+    </select>
+  )HTML");
+  document.View()->UpdateAllLifecyclePhases(
+      DocumentLifecycle::LifecycleUpdateReason::kTest);
+  HTMLSelectElement* select =
+      ToHTMLSelectElement(document.getElementById("select"));
+  ASSERT_TRUE(select);
+  InternalPopupMenu* menu =
+      InternalPopupMenu::Create(EmptyChromeClient::Create(), *select);
+
+  document.body()->SetInlineStyleProperty(CSSPropertyColor, "blue");
+
+  scoped_refptr<SharedBuffer> buffer = SharedBuffer::Create();
+
+  // Don't DCHECK in Element::EnsureComputedStyle.
+  static_cast<PagePopupClient*>(menu)->WriteDocument(buffer.get());
+}
+
+#endif  // defined(OS_ANDROID)
+
+}  // namespace blink