Fix crash when calling ScrollAnchor::clear from PaintLayer's destructor

third_party/WebKit/Source/core/layout/ScrollAnchor.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ScrollAnchor_h
 #define ScrollAnchor_h
 
 #include "core/CoreExport.h"
 #include "platform/geometry/LayoutPoint.h"
 #include "platform/heap/Handle.h"
@@ skipping 20 matching lines @@
   bool hasScroller() const { return m_scroller; }
 
   // The LayoutObject we are currently anchored to. Lazily computed during
   // save() and cached until the next call to clear().
   LayoutObject* anchorObject() const { return m_anchorObject; }
 
   // Indicates that the next save() should compute a new anchor for the
   // containing scroller and all ancestor scrollers.
   void clear();
 
+  // Indicates that the next save() should compute a new anchor for the
+  // containing scroller.
+  void clearSelf();
+
   // Records the anchor's location in relation to the scroller. Should be
   // called when the scroller is about to be laid out.
   void save();
 
   // Scrolls to compensate for any change in the anchor's relative location
   // since the most recent call to save(). Should be called immediately after
   // the scroller has been laid out.
   void restore();
 
   enum class Corner {
     TopLeft = 0,
     TopRight,
   };
   // Which corner of the anchor object we are currently anchored to.
   // Only meaningful if anchorObject() is non-null.
   Corner corner() const { return m_corner; }
 
   // Checks if we hold any references to the specified object.
   bool refersTo(const LayoutObject*) const;
 
   // Notifies us that an object will be removed from the layout tree.
   void notifyRemoved(LayoutObject*);
 
   DEFINE_INLINE_TRACE() { visitor->trace(m_scroller); }
 
  private:
-  // Indicates that the next save() should compute a new anchor for the
-  // containing scroller.
-  void clearSelf(bool unconditionally = false);
+  // Releases the anchor and conditionally clears the IsScrollAnchorObject bit
+  // on the LayoutObject.
+  void clearSelf(bool unconditionally);
 
   void findAnchor();
   bool computeScrollAnchorDisablingStyleChanged();
 
   enum WalkStatus { Skip = 0, Constrain, Continue, Return };
   struct ExamineResult {
     ExamineResult(WalkStatus s)
         : status(s), viable(false), corner(Corner::TopLeft) {}
 
     ExamineResult(WalkStatus s, Corner c)
@@ skipping 30 matching lines @@
   // the call to save.  In this state, additional calls to save are ignored,
   // to make things easier for multi-pass layout modes such as flexbox.
   // TODO(skobes): explore anchoring at frame boundaries instead of layouts,
   // which would allow this field to be removed.
   bool m_saved;
 };
 
 }  // namespace blink
 
 #endif  // ScrollAnchor_h