Merge 95074 - Crash in RenderScrollbarPart::imageChanged.

Source/WebCore/rendering/RenderScrollbar.cpp

Index: Source/WebCore/rendering/RenderScrollbar.cpp
===================================================================
--- Source/WebCore/rendering/RenderScrollbar.cpp	(revision 95979)
+++ Source/WebCore/rendering/RenderScrollbar.cpp	(working copy)
@@ -64,7 +64,15 @@
 
 RenderScrollbar::~RenderScrollbar()
 {
-    ASSERT(m_parts.isEmpty());
+    if (!m_parts.isEmpty()) {
+        // When a scrollbar is detached from its parent (causing all parts removal) and 
+        // ready to be destroyed, its destruction can be delayed because of RefPtr
+        // maintained in other classes such as EventHandler (m_lastScrollbarUnderMouse).
+        // Meanwhile, we can have a call to updateScrollbarPart which recreates the 
+        // scrollbar part. So, we need to destroy these parts since we don't want them
+        // to call on a destroyed scrollbar. See webkit bug 68009.
+        updateScrollbarParts(true);
+    }
 }
 
 RenderBox* RenderScrollbar::owningRenderer() const