Fix crash when calling ScrollAnchor::clear from PaintLayer's destructor

third_party/WebKit/Source/core/layout/ScrollAnchor.h

Index: third_party/WebKit/Source/core/layout/ScrollAnchor.h
diff --git a/third_party/WebKit/Source/core/layout/ScrollAnchor.h b/third_party/WebKit/Source/core/layout/ScrollAnchor.h
index 1490c6f7ef7f06e3afa93356ba1684003f07b758..d3333ba947d2db528fd8910cf7b20f40e8c60a4d 100644
--- a/third_party/WebKit/Source/core/layout/ScrollAnchor.h
+++ b/third_party/WebKit/Source/core/layout/ScrollAnchor.h
@@ -38,6 +38,10 @@ class CORE_EXPORT ScrollAnchor final {
   // containing scroller and all ancestor scrollers.
   void clear();
 
+  // Indicates that the next save() should compute a new anchor for the
+  // containing scroller.
+  void clearSelf();
+
   // Records the anchor's location in relation to the scroller. Should be
   // called when the scroller is about to be laid out.
   void save();
@@ -64,9 +68,9 @@ class CORE_EXPORT ScrollAnchor final {
   DEFINE_INLINE_TRACE() { visitor->trace(m_scroller); }
 
  private:
-  // Indicates that the next save() should compute a new anchor for the
-  // containing scroller.
-  void clearSelf(bool unconditionally = false);
+  // Releases the anchor and conditionally clears the IsScrollAnchorObject bit
+  // on the LayoutObject.
+  void clearSelf(bool unconditionally);
 
   void findAnchor();
   bool computeScrollAnchorDisablingStyleChanged();