Use ScrollAnchor in FrameView and PaintLayerScrollableArea.

third_party/WebKit/Source/core/layout/LayoutObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index e83ac35b2caf958aad3234cdc702f2e3b7e17e5f..0c0c87a7a3fce66a23f174c00b682e36279f3263 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -2661,6 +2661,32 @@ void LayoutObject::willBeRemovedFromTree()
     // Update cached boundaries in SVG layoutObjects if a child is removed.
     if (parent()->isSVG())
         parent()->setNeedsBoundariesUpdate();
+
+    clearScrollAnchorIfNeeded();
+}
+
+void LayoutObject::clearScrollAnchorIfNeeded() const
+{
+    if (!scrollAnchoringEnabled())
+        return;
+
+    PaintLayer* layer = parent()->enclosingLayer();
+
+    // Walk up the layer tree to clear any scroll anchors that reference us.
+    // TODO(skobes): Should this be a hash lookup or a data member instead?
+    while (layer) {
+        if (PaintLayerScrollableArea* scrollableArea = layer->scrollableArea()) {
+            ScrollAnchor& anchor = scrollableArea->scrollAnchor();
+            if (anchor.layoutObject() == this)
+                anchor.clear();
+        }
+        layer = layer->parent();

[ojan, 2016/02/02 06:51:01]

I think this is O(n^2) in the depth of the layer tree on tear down. We start
teardown at the top of the tree and at each node walk up. I'm a little too
braindead after a day of CSSWG meetings to think about what the more efficient
way to do it is, but I'll mention it for now and CC esprehn who might have good
ideas.

[skobes, 2016/02/02 22:39:10]

Yes my first thought was to add a back pointer to the scroller in LayoutObject,
but it seems bad for every LayoutObject to have this.  It would be a natural fit
in a LayoutObjectRareData struct, which doesn't currently exist.  Or we can add
a hashmap.  Though there was a thread on blink-dev a while back about hashmaps
being worse than data members.  So I decided to do the simple thing for now. :)

+    }
+    if (FrameView* view = frameView()) {
+        ScrollAnchor& anchor = view->scrollAnchor();
+        if (anchor.layoutObject() == this)
+            anchor.clear();
+    }
 }
 
 void LayoutObject::removeFromLayoutFlowThread()
@@ -3527,6 +3553,13 @@ void LayoutObject::clearObjectPaintProperties()
     objectPaintPropertiesMap().remove(this);
 }
 
+bool LayoutObject::scrollAnchoringEnabled() const
+{
+    if (Settings* settings = document().settings())
+        return settings->scrollAnchoringEnabled();
+    return false;
+}
+
 } // namespace blink
 
 #ifndef NDEBUG