Avoid clearing pointers on layers still in the mapping's vector of layers.

Source/core/layout/compositing/CompositedDeprecatedPaintLayerMapping.cpp

 /*
  * Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 2284 matching lines @@
             break;
 
     if (layerIndex == m_squashedLayers.size())
         return;
 
     m_squashedLayers.remove(layerIndex);
 }
 
 void CompositedDeprecatedPaintLayerMapping::finishAccumulatingSquashingLayers(size_t nextSquashedLayerIndex)
 {
-    // Any additional squashed Layers in the array no longer exist, and removing invalidates the
-    // squashingLayer contents.
     if (nextSquashedLayerIndex < m_squashedLayers.size()) {
-        for (size_t i = m_squashedLayers.size(); i > nextSquashedLayerIndex; --i)
-            m_squashedLayers[i-1].paintLayer->setGroupedMapping(nullptr, DeprecatedPaintLayer::DoNotInvalidateLayerAndRemoveFromMapping);
+        // Any additional squashed Layers in the array no longer belong here, but they might have been
+        // added already at an earlier index. Clear pointers on those that do not appear in the valid set
+        // before removing all the extra entries.
+        for (size_t i = nextSquashedLayerIndex; i < m_squashedLayers.size(); ++i) {
+            DeprecatedPaintLayer* layerToRemove = m_squashedLayers[i].paintLayer;
+            size_t previousIndex = 0;
+            for (; previousIndex < nextSquashedLayerIndex; ++previousIndex) {
+                if (m_squashedLayers[previousIndex].paintLayer == layerToRemove)
+                    break;
+            }
+            if (previousIndex == nextSquashedLayerIndex)
+                layerToRemove->setGroupedMapping(nullptr, DeprecatedPaintLayer::DoNotInvalidateLayerAndRemoveFromMapping);
+        }
         m_squashedLayers.remove(nextSquashedLayerIndex, m_squashedLayers.size() - nextSquashedLayerIndex);
     }
 }
 
 String CompositedDeprecatedPaintLayerMapping::debugName(const GraphicsLayer* graphicsLayer)
 {
     String name;
     if (graphicsLayer == m_graphicsLayer.get()) {
         name = m_owningLayer.debugName();
     } else if (graphicsLayer == m_squashingContainmentLayer.get()) {
@@ skipping 31 matching lines @@
     } else if (graphicsLayer == m_scrollingBlockSelectionLayer.get()) {
         name = "Scrolling Block Selection Layer";
     } else {
         ASSERT_NOT_REACHED();
     }
 
     return name;
 }
 
 } // namespace blink