Fix crash when calling ScrollAnchor::clear from PaintLayer's destructor

third_party/WebKit/Source/core/layout/ScrollAnchorTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ScrollAnchor.h"
 
 #include "core/dom/ClientRect.h"
 #include "core/frame/VisualViewport.h"
 #include "core/layout/LayoutBox.h"
 #include "core/layout/LayoutTestHelper.h"
@@ skipping 300 matching lines @@
   EXPECT_EQ(250, scroller->scrollOffsetInt().height());
   EXPECT_EQ(block2->layoutObject(), scrollAnchor(scroller).anchorObject());
 
   // Test that the anchor object can be destroyed without affecting the scroll
   // position.
   block2->remove();
   update();
   EXPECT_EQ(250, scroller->scrollOffsetInt().height());
 }
 
+// Verify that a nested scroller with a div that has its own PaintLayer can be
+// removed without causing a crash. This test passes if it doesn't crash.
+TEST_F(ScrollAnchorTest, RemoveScrollerWithLayerInScrollingDiv) {
+  setBodyInnerHTML(
+      "<style>"
+      "    body { height: 2000px }"
+      "    #scroller { overflow: scroll; width: 500px; height: 400px}"
+      "    #block1 { height: 100px; width: 100px; overflow: hidden}"
+      "    #anchor { height: 1000px; }"
+      "</style>"
+      "<div id='changer1'></div>"
+      "<div id='scroller'>"
+      "  <div id='changer2'></div>"
+      "  <div id='block1'></div>"
+      "  <div id='anchor'></div>"
+      "</div>");
+
+  ScrollableArea* viewport = layoutViewport();
+  ScrollableArea* scroller =
+      scrollerForElement(document().getElementById("scroller"));
+  Element* changer1 = document().getElementById("changer1");
+  Element* changer2 = document().getElementById("changer2");
+  Element* anchor = document().getElementById("anchor");
+
+  scroller->scrollBy(ScrollOffset(0, 150), UserScroll);
+  scrollLayoutViewport(ScrollOffset(0, 50));
+
+  // In this layout pass both the inner and outer scroller will anchor to
+  // #anchor.
+  setHeight(changer1, 100);
+  setHeight(changer2, 100);
+  EXPECT_EQ(250, scroller->scrollOffsetInt().height());
+  EXPECT_EQ(anchor->layoutObject(), scrollAnchor(scroller).anchorObject());
+  EXPECT_EQ(anchor->layoutObject(), scrollAnchor(viewport).anchorObject());
+
+  // Test that the inner scroller can be destroyed without crashing.
+  document().getElementById("scroller")->remove();
+  update();
+}
+
 TEST_F(ScrollAnchorTest, ExcludeAnonymousCandidates) {
   setBodyInnerHTML(
       "<style>"
       "    body { height: 3500px }"
       "    #div {"
       "        position: relative; background-color: pink;"
       "        top: 5px; left: 5px; width: 100px; height: 3500px;"
       "    }"
       "    #inline { padding-left: 10px }"
       "</style>"
@@ skipping 695 matching lines @@
 
   scrollLayoutViewport(ScrollOffset(-50, 0));
 
   a->setAttribute(HTMLNames::styleAttr, "width: 200px");
   b->setAttribute(HTMLNames::styleAttr, "height: 150px");
   update();
   EXPECT_EQ(ScrollOffset(-100, 150), viewport->scrollOffset());
   EXPECT_EQ(c->layoutObject(), scrollAnchor(viewport).anchorObject());
 }
 }