Fix scroll anchoring crash from removing an anonymous block anchor

third_party/WebKit/Source/core/layout/ScrollAnchor.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ScrollAnchor.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/UseCounter.h"
 #include "core/layout/line/InlineTextBox.h"
 #include "core/paint/PaintLayerScrollableArea.h"
@@ skipping 101 matching lines @@
     bool skippedByContainerLookup = false;
     candidate->container(scrollerLayoutBox(scroller), &skippedByContainerLookup);
     return !skippedByContainerLookup;
 }
 
 ScrollAnchor::ExamineResult ScrollAnchor::examine(const LayoutObject* candidate) const
 {
     if (candidate->isLayoutInline())
         return ExamineResult(Continue);
 
+    // Anonymous blocks are not in the DOM tree and it may be hard for
+    // developers to reason about the anchor node.
+    if (candidate->isAnonymous())
+        return ExamineResult(Continue);
+
     if (!candidate->isText() && !candidate->isBox())
         return ExamineResult(Skip);
 
     if (!candidateMovesWithScroller(candidate, m_scroller))
         return ExamineResult(Skip);
 
     LayoutRect candidateRect = relativeBounds(candidate, m_scroller);
     LayoutRect visibleRect = scrollerLayoutBoxItem(m_scroller).overflowClipRect(LayoutPoint());
 
     bool occupiesSpace = candidateRect.width() > 0 && candidateRect.height() > 0;
@@ skipping 162 matching lines @@
 
 void ScrollAnchor::notifyRemoved(LayoutObject* layoutObject)
 {
     if (m_current.m_anchorObject == layoutObject)
         m_current.clear();
     if (m_lastAdjusted.m_anchorObject == layoutObject)
         m_lastAdjusted.clear();
 }
 
 } // namespace blink