Reproduces the production failure seen on a print-preview page: the surrogate
intercepts an inline PDF download in a child frame and replaces that frame's
document with its own grey body plus an
<embed type="application/pdf">, written through
Document::SetContent(). Page script in the main world
that touches an unknown property on that embed forces
HTMLPlugInElement::PluginWrapper() →
LayoutEmbeddedContentForJSBindings(), which updates style,
lays out and flushes plugin updates synchronously. If that happens
while SetContent() is still running, the embed resolves before
the surrogate has marked it, so it is reported as externally handled and
becomes a child frame on about:blank - a blank area with no
PDF and no download.
The probe runs from a MutationObserver on the child document. Its records are
delivered at the microtask checkpoint inside
Document::FinishedParsing(), i.e. inside the
SetContent() call itself - the same window the production trace
showed (during_injection=1 trigger=js-binding marker=0).