Ignore delayed scroll offset clamp if PLSA was destroyed.

Bug: 842495
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I41b3a973a2f9aa36e245e4cfbe1ad8f0de4b5ad8
Reviewed-on: https://chromium-review.googlesource.com/1075826
Commit-Queue: Robert Flack <flackr@chromium.org>
Reviewed-by: David Bokan <bokan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#562516}

third_party/blink/renderer/core/paint/paint_layer_scrollable_area.cc

@@ -1039,6 +1039,9 @@ void PaintLayerScrollableArea::UpdateAfterLayout() {
 }
 
 void PaintLayerScrollableArea::ClampScrollOffsetAfterOverflowChange() {
+  if (HasBeenDisposed())
+    return;
+
   // If a vertical scrollbar was removed, the min/max scroll offsets may have
   // changed, so the scroll offsets needs to be clamped.  If the scroll offset
   // did not change, but the scroll origin *did* change, we still need to notify

third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h

@@ -201,7 +201,7 @@ class CORE_EXPORT PaintLayerScrollableArea final
   // last DelayScrollOffsetClampScope object is destructed, all
   // PaintLayerScrollableArea's that delayed clamping their offsets will
   // immediately clamp them.
-  class DelayScrollOffsetClampScope {
+  class CORE_EXPORT DelayScrollOffsetClampScope {
     STACK_ALLOCATED();
 
    public:

third_party/blink/renderer/core/paint/paint_layer_scrollable_area_test.cc

@@ -931,4 +931,21 @@ TEST_F(PaintLayerScrollableAreaTest, CompositedStickyDescendant) {
                                   .To2DTranslation());
 }
 
+// Delayed scroll offset clamping should not crash. https://crbug.com/842495
+TEST_F(PaintLayerScrollableAreaTest, IgnoreDelayedScrollOnDestroyedLayer) {
+  SetBodyInnerHTML(R"HTML(
+    <div id=scroller style="overflow: scroll; width: 200px; height: 200px;">
+      <div style="height: 1000px;"></div>
+    </div>
+  )HTML");
+  Element* scroller = GetDocument().getElementById("scroller");
+  {
+    PaintLayerScrollableArea::DelayScrollOffsetClampScope scope;
+    PaintLayerScrollableArea::DelayScrollOffsetClampScope::SetNeedsClamp(
+        scroller->GetLayoutBox()->GetScrollableArea());
+    scroller->SetInlineStyleProperty(CSSPropertyDisplay, CSSValueNone);
+    GetDocument().View()->UpdateAllLifecyclePhases();
+  }
+}
+
 }  // namespace blink