Speculative fix for DCHECK failure

The root cause for the failure is most likely a change in when the
flags controlling frame throttling are updated. That changed when the
IntersectionObserver steps were moved to run in a post-lifecycle
step. It's possible that a frame was marked as throttled at the time
that UpdateAllLifecyclePhases ran, so it was skipped for update; but
the throttled flag was flipped to unthrottled before the code path
where the crash occurs, so that the call to ShouldThrottleRendering()
does not reflect the state of throttling when the lifecycle ran.

BUG=938651
R=schenney@chromium.org

Change-Id: Ifb7e50d40f096e333e45e5e8610ef7ab7671bee7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1506757
Commit-Queue: Stefan Zager <szager@chromium.org>
Reviewed-by: Stephen Chenney <schenney@chromium.org>
Cr-Commit-Position: refs/heads/master@{#638417}

third_party/blink/renderer/core/layout/layout_embedded_content.cc

@@ -172,7 +172,13 @@ bool LayoutEmbeddedContent::NodeAtPoint(
 
   // A hit test can never hit an off-screen element; only off-screen iframes are
   // throttled; therefore, hit tests can skip descending into throttled iframes.
-  if (local_frame_view->ShouldThrottleRendering()) {
+  // We also check the document lifecycle state because the frame may have been
+  // throttled at the time lifecycle updates happened, in which case it will not
+  // be up-to-date and we can't hit test it.
+  if (local_frame_view->ShouldThrottleRendering() ||
+      !local_frame_view->GetFrame().GetDocument() ||
+      local_frame_view->GetFrame().GetDocument()->Lifecycle().GetState() <
+          DocumentLifecycle::kCompositingClean) {
     return NodeAtPointOverEmbeddedContentView(result, location_in_container,
                                               accumulated_offset, action);
   }