So this function walks up the docshell tree (same-type only) looking for a BROWSER frametype, and if it finds one it returns it, otherwise returns REGULAR.
Looking at the usage of mFrameType, it does seem like this value can change up the tree at runtime, via
SetFrameType, which is called by
This property is not sensitive enough to require quarantining within the process.
MaybeCreateDocShell because the property being set at docshell creation time is forwardable to children.
The other case (
BrowserChild::UpdateFrameType), only seems to be called in the code path for swapping frame loaders. I'm not sure when or why frame loaders get swapped yet, and I tried to look deeper into whether swapping frame loaders allows us to discount the possibility of child docshells existing, but didn't find anything conclusive.
This flag seems like it can be cached in BrowsingContext, and propagated down the tree eagerly as an inherited constant.
This does seem like a bit of work.