Fix crash when scrolling in a remote process frame

This is occurring because we try to get the RootScrollerController from the top
level Document by calling topDocument(). Since we're in a remote Frame though,
topDocument returns the current RootScrollerController's Document and so we
infinitely recurse into isViewportScrollCallback.

This is a quick fix to the problem while I come up with a better long term
solution for OOPIFs.

BUG=641775

Review-Url: https://codereview.chromium.org/2290353002
Cr-Commit-Position: refs/heads/master@{#415348}

third_party/WebKit/Source/core/page/scrolling/RootScrollerController.cpp

@@ -26,7 +26,7 @@ bool fillsViewport(const Element& element)
 
     LayoutObject* layoutObject = element.layoutObject();
 
-    // TODO(bokan): Broken for OOPIF.
+    // TODO(bokan): Broken for OOPIF. crbug.com/642378.
     Document& topDocument = element.document().topDocument();
 
     Vector<FloatQuad> quads;
@@ -159,6 +159,13 @@ bool RootScrollerController::isViewportScrollCallback(
     // do the comparison.
     DCHECK(!m_document->isInMainFrame());
 
+    // If we don't have a local owner we must be in a remote iframe.
+    // RootScrollerController doesn't yet work in OOPIF and in any case we have
+    // no way to get at the ViewportScrollCallback so just return false.
+    // TODO(bokan): Make document.rootScroller work in OOPIF. crbug.com/642378.
+    if (!m_document->localOwner())
+        return false;
+
     RootScrollerController* topDocumentController =
         m_document->topDocument().rootScrollerController();
     return topDocumentController->isViewportScrollCallback(callback);

third_party/WebKit/Source/core/page/scrolling/TopDocumentRootScrollerController.h

@@ -26,7 +26,7 @@ class ViewportScrollCallback;
 // as the root scroller and ensures that Element is used to scroll top controls
 // and provide overscroll effects.
 // TODO(bokan): This class is currently OOPIF unaware. It should be broken into
-// a standalone class and placed on a Page level object. crbug.com/505516
+// a standalone class and placed on a Page level object. crbug.com/642378.
 class CORE_EXPORT TopDocumentRootScrollerController
     : public RootScrollerController {
 public: