Fix flakiness in fast/layers/scrollable-area-removed-on-scroll-crash.html

There are multiple accessibility notifications but the test should only
continue when it receives the one for the programmatic scroll.

This patch also fixes another use after free from trying to use the smooth
scroll coordinator.

Bug: 797298,812702
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I1340d8cd1d5d3e53e75d9ab0c5f50b523041b187
Reviewed-on: https://chromium-review.googlesource.com/922685
Commit-Queue: Robert Flack <flackr@chromium.org>
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#537317}

third_party/WebKit/LayoutTests/TestExpectations

@@ -3272,8 +3272,6 @@ crbug.com/802835 virtual/outofblink-cors/external/wpt/fetch/corb/img-png-mislabe
 crbug.com/802835 external/wpt/fetch/corb/script-html-correctly-labeled.tentative.sub.html [ Failure ]
 crbug.com/802835 virtual/outofblink-cors/external/wpt/fetch/corb/script-html-correctly-labeled.tentative.sub.html [ Failure ]
 
-crbug.com/812702 fast/layers/scrollable-area-removed-on-scroll-crash.html [ Pass Failure ]
-
 crbug.com/812941 [ Win7 ] external/wpt/css/css-multicol/multicol-columns-004.xht [ Failure Pass ]
 crbug.com/812941 [ Win7 ] external/wpt/css/css-multicol/multicol-count-non-integer-003.xht [ Failure Pass ]
 crbug.com/812941 [ Win7 ] external/wpt/css/css-multicol/multicol-gap-000.xht [ Failure Pass ]

third_party/WebKit/LayoutTests/fast/layers/scrollable-area-removed-on-scroll-crash.html

@@ -5,7 +5,8 @@
   overflow: scroll
 }
 .inner {
-  width: 2000px
+  width: 2000px;
+  height: 50px;
 }
 </style>
 <p>This tests that an accessibility controller scroll update notification which
@@ -18,8 +19,8 @@ description("Scrollable area removed on scroll");
 
 window.jsTestIsAsync = true;
 
-accessibilityController.addNotificationListener(function () {
-  if (!window.container)
+accessibilityController.addNotificationListener(function (evt, type) {
+  if (type != "ScrollPositionChanged")
     return;
   container.parentNode.removeChild(container);
   setTimeout(function(){

third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp

@@ -253,6 +253,8 @@ PlatformChromeClient* PaintLayerScrollableArea::GetChromeClient() const {
 
 SmoothScrollSequencer* PaintLayerScrollableArea::GetSmoothScrollSequencer()
     const {
+  if (HasBeenDisposed())
+    return nullptr;
   if (Page* page = GetLayoutBox()->GetFrame()->GetPage())
     return page->GetSmoothScrollSequencer();
   return nullptr;