DOMLazyTree, populate <object> before insertion into DOM (#6691)

(cherry picked from commit 2af4765a2a)

src/renderers/dom/client/utils/DOMLazyTree.js

@@ -11,9 +11,14 @@
 
 'use strict';
 
+var DOMNamespaces = require('DOMNamespaces');
+
 var createMicrosoftUnsafeLocalFunction = require('createMicrosoftUnsafeLocalFunction');
 var setTextContent = require('setTextContent');
 
+var ELEMENT_NODE_TYPE = 1;
+var DOCUMENT_FRAGMENT_NODE_TYPE = 11;
+
 /**
  * In IE (8-11) and Edge, appending nodes with no children is dramatically
  * faster than appending a full subtree, so we essentially queue up the
@@ -56,8 +61,15 @@ var insertTreeBefore = createMicrosoftUnsafeLocalFunction(
     // DocumentFragments aren't actually part of the DOM after insertion so
     // appending children won't update the DOM. We need to ensure the fragment
     // is properly populated first, breaking out of our lazy approach for just
-    // this level.
-    if (tree.node.nodeType === 11) {
+    // this level. Also, some <object> plugins (like Flash Player) will read
+    // <param> nodes immediately upon insertion into the DOM, so <object>
+    // must also be populated prior to insertion into the DOM.
+    if (tree.node.nodeType === DOCUMENT_FRAGMENT_NODE_TYPE
+        ||
+        tree.node.nodeType === ELEMENT_NODE_TYPE &&
+        tree.node.nodeName.toLowerCase() === 'object' &&
+        (tree.node.namespaceURI == null ||
+         tree.node.namespaceURI === DOMNamespaces.html)) {
       insertTreeChildren(tree);
       parentNode.insertBefore(tree.node, referenceNode);
     } else {