Use ScrollAnchor in FrameView and PaintLayerScrollableArea.

third_party/WebKit/Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 2643 matching lines @@
     }
 
     if (isOutOfFlowPositioned() && parent()->childrenInline())
         parent()->dirtyLinesFromChangedChild(this);
 
     removeFromLayoutFlowThread();
 
     // Update cached boundaries in SVG layoutObjects if a child is removed.
     if (parent()->isSVG())
         parent()->setNeedsBoundariesUpdate();
+
+    clearScrollAnchorIfNeeded();
+}
+
+void LayoutObject::clearScrollAnchorIfNeeded() const
+{
+    if (!scrollAnchoringEnabled())
+        return;
+
+    PaintLayer* layer = parent()->enclosingLayer();
+
+    // Walk up the layer tree to clear any scroll anchors that reference us.
+    // TODO(skobes): Should this be a hash lookup or a data member instead?
+    while (layer) {
+        if (PaintLayerScrollableArea* scrollableArea = layer->scrollableArea()) {
+            ScrollAnchor& anchor = scrollableArea->scrollAnchor();
+            if (anchor.layoutObject() == this)
+                anchor.clear();
+        }
+        layer = layer->parent();

[ojan, 2016/02/02 06:51:01]

I think this is O(n^2) in the depth of the layer tree on tear down. We start
teardown at the top of the tree and at each node walk up. I'm a little too
braindead after a day of CSSWG meetings to think about what the more efficient
way to do it is, but I'll mention it for now and CC esprehn who might have good
ideas.

[skobes, 2016/02/02 22:39:10]

Yes my first thought was to add a back pointer to the scroller in LayoutObject,
but it seems bad for every LayoutObject to have this.  It would be a natural fit
in a LayoutObjectRareData struct, which doesn't currently exist.  Or we can add
a hashmap.  Though there was a thread on blink-dev a while back about hashmaps
being worse than data members.  So I decided to do the simple thing for now. :)

+    }
+    if (FrameView* view = frameView()) {
+        ScrollAnchor& anchor = view->scrollAnchor();
+        if (anchor.layoutObject() == this)
+            anchor.clear();
+    }
 }
 
 void LayoutObject::removeFromLayoutFlowThread()
 {
     if (!isInsideFlowThread())
         return;
 
     // Sometimes we remove the element from the flow, but it's not destroyed at that time.
     // It's only until later when we actually destroy it and remove all the children from it.
     // Currently, that happens for firstLetter elements and list markers.
@@ skipping 846 matching lines @@
     ASSERT(RuntimeEnabledFeatures::slimmingPaintV2Enabled());
     objectPaintPropertiesMap().set(this, paintProperties);
 }
 
 void LayoutObject::clearObjectPaintProperties()
 {
     ASSERT(RuntimeEnabledFeatures::slimmingPaintV2Enabled());
     objectPaintPropertiesMap().remove(this);
 }
 
+bool LayoutObject::scrollAnchoringEnabled() const
+{
+    if (Settings* settings = document().settings())
+        return settings->scrollAnchoringEnabled();
+    return false;
+}
+
 } // namespace blink
 
 #ifndef NDEBUG
 
 void showTree(const blink::LayoutObject* object)
 {
     if (object)
         object->showTreeForThis();
     else
         fprintf(stderr, "Cannot showTree. Root is (nil)\n");
@@ skipping 18 matching lines @@
         const blink::LayoutObject* root = object1;
         while (root->parent())
             root = root->parent();
         root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
     } else {
         fprintf(stderr, "Cannot showLayoutTree. Root is (nil)\n");
     }
 }
 
 #endif