Don't crash when a scrollbar layer has its ScrollableArea detached.

A blink::Scrollbar may have its ScrollableArea detached, but the layer
remains in the layer tree, so it attempts to paint. In this case the
layer does not need to paint and we can early out. It is not clear why
PaintLayerScrollableArea::ScrollbarManager::DestroyScrollbar() happens
but CompositedLayerMapping::UpdateOverflowControlsLayers() does not
destroy and remove the layer from the tree.

R=pdr@chromium.org

Bug: 860499
Change-Id: I536ebb1258147c90f1f48d90d195a607230b715e
Reviewed-on: https://chromium-review.googlesource.com/1132418Reviewed-by: Jianpeng Chao <chaopeng@chromium.org>
Reviewed-by: Stephen Chenney <schenney@chromium.org>
Commit-Queue: danakj <danakj@chromium.org>
Cr-Commit-Position: refs/heads/master@{#575316}

third_party/blink/renderer/platform/scroll/scrollbar_layer_delegate.cc

@@ -109,6 +109,12 @@ gfx::Rect ScrollbarLayerDelegate::NinePatchThumbAperture() const {
 }
 
 bool ScrollbarLayerDelegate::HasTickmarks() const {
+  // TODO(crbug.com/860499): Remove this condition, it should not occur.
+  // Layers may exist and be painted for a |scrollbar_| that has had its
+  // ScrollableArea detached. This seems weird because if the area is detached
+  // the layer should be destroyed but here we are. https://crbug.com/860499.
+  if (!scrollbar_->GetScrollableArea())
+    return false;
   // When the frame is throttled, the scrollbar will not be painted because
   // the frame has not had its lifecycle updated. Thus the actual value of
   // HasTickmarks can't be known and may change once the frame is unthrottled.
@@ -126,6 +132,14 @@ void ScrollbarLayerDelegate::PaintPart(cc::PaintCanvas* canvas,
   PaintCanvasAutoRestore auto_restore(canvas, true);
   blink::Scrollbar& scrollbar = *scrollbar_;
 
+  // TODO(crbug.com/860499): Remove this condition, it should not occur.
+  // Layers may exist and be painted for a |scrollbar_| that has had its
+  // ScrollableArea detached. This seems weird because if the area is detached
+  // the layer should be destroyed but here we are.
+  if (!scrollbar_->GetScrollableArea())
+    return;
+  // When the frame is throttled, the scrollbar will not be painted because
+  // the frame has not had its lifecycle updated.
   if (scrollbar.GetScrollableArea()->IsThrottled())
     return;