Created attachment 345746 [details] testcase Steps to reproduce the problem: 1. Download and extract attached testcase.zip 2. Open index.html What is the expected behavior? At first there is a red circle. It will be hidden after 0.5 second, and it appears again. What went wrong? The red circle, the content of the <object> element, is not displayed again despite the <object> is shown. This issue won't occur if the URL does not include "#". Only Safari and Chrome have this issue. Firefox, Edge and IE work well. chrome bug: https://bugs.chromium.org/p/chromium/issues/detail?id=865932
Confirmed that this issue occurs in Mac nightly r234734.
When "display: none" is set on an <object> that behaves as an iframe we detach the frame view of the page it is displaying. Subsequently setting "display: inline" asked the loader to load the page the <object> refers to. Loading a URL that contains a fragment goes through a specialized code path since the result of such a load is to scroll the frame to an anchor. Unlike a traditional page load, this code path assumes that the frame view it scrolls is associated with an owner frame element (e.g. <object>). But this is not always true as demonstrated by the test case.
This issue is not specific to hiding and showing and <object> that behaves as an iframe. In general, navigating an <object> to a fragment in the same document that it is displaying will cause the same visual result: an empty repaint.
Created attachment 346875 [details] Patch and layout tests
Comment on attachment 346875 [details] Patch and layout tests View in context: https://bugs.webkit.org/attachment.cgi?id=346875&action=review > Source/WebCore/ChangeLog:8 > + Fixes and issue where an HTML object element that behaves like an iframe and references a resource an issue
Committed in <https://trac.webkit.org/changeset/234762>.
<rdar://problem/43147455>