GitLab

We tried to update the fragment anchor position immediately when all
script blocking sheets are removed. As part of that update we do a
style and layout update. The last script blocking sheet may be
removed as part of removing a style element from the DOM. Updating
style and layout in the middle of a DOM operation is not safe.

Instead, update the fragment anchor position during the next safe
lifecycle update. The crash was caused by Document still pointing to a
documentElement being removed while updating the style and layout tree,
but its parent pointer had already been set to null.

Bug: 771088
Change-Id: Iaaaeece23d795c2e41d31b9fb97fc795eb2b8305
Reviewed-on: https://chromium-review.googlesource.com/698305
Commit-Queue: Rune Lillesveen <rune@opera.com>
Reviewed-by: Steve Kobes <skobes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#506854}