bindings: Fix ScrollTimeline

An IDL dictionary member ScrolltimeElementBasedoffset.target's type
is non-nullable Element, but there are some routines that can store a
nullptr or access without checking it is available.

This CL fixes them.

Bug: 839389
Change-Id: Ic9529c39fd4a52935570e461db85134f2c5862aa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2557760Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Hitoshi Yoshida <peria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#830907}

third_party/blink/renderer/core/animation/css/css_scroll_timeline.cc

@@ -82,8 +82,10 @@ double ComputeElementOffsetThreshold(const CSSValue* value) {
 ScrollTimelineElementBasedOffset* ComputeElementBasedOffset(
     Document& document,
     const cssvalue::CSSElementOffsetValue* value) {
-  auto* offset = MakeGarbageCollected<ScrollTimelineElementBasedOffset>();
-  offset->setTarget(ComputeElementOffsetTarget(document, value->Target()));
+  auto* offset = ScrollTimelineElementBasedOffset::Create();
+  Element* target = ComputeElementOffsetTarget(document, value->Target());
+  if (target)
+    offset->setTarget(target);
   offset->setEdge(ComputeElementOffsetEdge(value->Edge()));
   offset->setThreshold(ComputeElementOffsetThreshold(value->Threshold()));
   return offset;

third_party/blink/renderer/core/animation/scroll_timeline_offset.cc

@@ -58,8 +58,11 @@ bool ElementBasedOffsetsEqual(ScrollTimelineElementBasedOffset* o1,
     return true;
   if (!o1 || !o2)
     return false;
-  return (o1->edge() == o2->edge()) && (o1->target() == o2->target()) &&
-         (o1->threshold() == o2->threshold());
+  // TODO(crbug.com/1070871): Use targetOr(nullptr) after migration is done.
+  Element* target_or_null1 = o1->hasTarget() ? o1->target() : nullptr;
+  Element* target_or_null2 = o2->hasTarget() ? o2->target() : nullptr;
+  return target_or_null1 == target_or_null2 && o1->edge() == o2->edge() &&
+         o1->threshold() == o2->threshold();
 }
 
 CSSKeywordValue* GetCSSKeywordValue(const ScrollTimelineOffsetValue& offset) {