Fix crash when calling ScrollAnchor::clear from PaintLayer's destructor

third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights
  * reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@gmail.com>
@@ skipping 159 matching lines @@
     m_resizer->destroy();
 
   clearScrollAnimators();
 
   // Note: it is not safe to call ScrollAnchor::clear if the document is being
   // destroyed, because LayoutObjectChildList::removeChildNode skips the call to
   // willBeRemovedFromTree,
   // leaving the ScrollAnchor with a stale LayoutObject pointer.
   if (RuntimeEnabledFeatures::scrollAnchoringEnabled() &&
       !box().documentBeingDestroyed())
-    m_scrollAnchor.clear();
+    m_scrollAnchor.clearSelf();
 
 #if ENABLE(ASSERT)
   m_hasBeenDisposed = true;
 #endif
 }
 
 DEFINE_TRACE(PaintLayerScrollableArea) {
   visitor->trace(m_scrollbarManager);
   visitor->trace(m_scrollAnchor);
   ScrollableArea::trace(visitor);
@@ skipping 1788 matching lines @@
 
 void PaintLayerScrollableArea::DelayScrollOffsetClampScope::
     clampScrollableAreas() {
   for (auto& scrollableArea : *s_needsClamp)
     scrollableArea->clampScrollOffsetsAfterLayout();
   delete s_needsClamp;
   s_needsClamp = nullptr;
 }
 
 }  // namespace blink