[PSA] re Iframe Render Throttling

[W. James MacLean]

tl;dr Shortly (before M112 branch) I hope to enable a fix we landed for crbug.com/958475, designed to make sure that same-process, cross-origin iframes with display:none or that are not visible experience the same render throttling behavior as cross-process iframes. Our previous attempt to land this fix caused problems for some sites that relied on rAF and ResizeObserver for these frames, but we hope that these issues are now resolved. There is an enterprise policy to allow short-term opting-out of this fix, to allow sites to adapt. It can also be disabled in chrome://flags.

Background

At present, display:none and non-visible (i.e. a non-zero area frame that is outside the viewport) cross-origin iframes are render throttled for technical reasons when rendered cross-process, but are not if they're rendered same-process. This leads to unpredictable behavior for developers, who shouldn't have to know the underlying process model being used to render the page. It could also be used by malicious actors to probe and see whether or not a browsing session has site/origin isolation enabled. Throttled iframes lose access to requestAnimationFrame and ResizeObserver, so the different throttling approaches will affect web developers.

This fix will standardize throttling so it applies to all cross-origin iframes, regardless of whether they are same-process or cross-process.

If issues arise due to this change, please file a bug assigned to me (wjma...@chromium.org). The new throttling behavior can be temporarily disabled at chrome://flags/#enable-throttle-display-none-and-visibility-hidden-cross-origin-iframes .

Tracked here:

Bug: https://bugs.chromium.org/p/chromium/issues/detail?id=958475

Chrome Feature: https://chromestatus.com/feature/5175574929080320