Fix scroll anchoring crash from removing an anonymous block anchor

third_party/WebKit/Source/core/layout/ScrollAnchorTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ScrollAnchor.h"
 
 #include "core/layout/LayoutBox.h"
 #include "core/layout/LayoutTestHelper.h"
 #include "core/paint/PaintLayerScrollableArea.h"
 #include "platform/testing/HistogramTester.h"
@@ skipping 141 matching lines @@
     setHeight(block1, 200);
     EXPECT_EQ(250, scroller->scrollPosition().y());
     EXPECT_EQ(block2->layoutObject(), scrollAnchor(scroller).anchorObject());
 
     // Test that the anchor object can be destroyed without affecting the scroll position.
     block2->remove();
     update();
     EXPECT_EQ(250, scroller->scrollPosition().y());
 }
 
+TEST_F(ScrollAnchorTest, ExcludeAnonymousCandidates)
+{
+    setBodyInnerHTML(
+        "<style>"
+        "    body { height: 3500px }"
+        "    #div {"
+        "        position: relative; background-color: pink;"
+        "        top: 5px; left: 5px; width: 100px; height: 3500px;"
+        "    }"
+        "    #inline { padding-left: 10px }"
+        "</style>"
+        "<div id='div'>"
+        "    <a id='inline'>text</a>"
+        "    <p id='block'>Some text</p>"
+        "</div>");
+
+    ScrollableArea* viewport = layoutViewport();
+    Element* inlineElem = document().getElementById("inline");
+    EXPECT_TRUE(inlineElem->layoutObject()->parent()->isAnonymous());
+
+    // Scroll #div into view, making anonymous block a viable candidate.
+    document().getElementById("div")->scrollIntoView();
+
+    // Trigger layout and verify that we don't anchor to the anonymous block.
+    document().getElementById("div")->setAttribute(HTMLNames::styleAttr,
+        AtomicString("top: 6px"));
+    update();
+    EXPECT_EQ(inlineElem->layoutObject()->slowFirstChild(),
+        scrollAnchor(viewport).anchorObject());
+}
+
 TEST_F(ScrollAnchorTest, FullyContainedInlineBlock)
 {
     // Exercises every WalkStatus value:
     // html, body -> Constrain
     // #outer -> Continue
     // #ib1, br -> Skip
     // #ib2 -> Return
     setBodyInnerHTML(
         "<style>"
         "    body { height: 1000px }"
@@ skipping 32 matching lines @@
 
     setHeight(document().body(), 1100);
     EXPECT_EQ(document().getElementById("b")->layoutObject()->slowFirstChild(),
         scrollAnchor(layoutViewport()).anchorObject());
 }
 
 TEST_F(ScrollAnchorTest, ExcludeFixedPosition)
 {
     setBodyInnerHTML(
         "<style>"
-        "    body { height: 1000px; padding: 20px }"
+        "    body { height: 1000px; padding: 20px; }"
         "    div { position: relative; top: 100px; }"
         "    #f { position: fixed }"
         "</style>"
         "<div id=f>fixed</div>"
         "<div id=c>content</div>");
 
     scrollLayoutViewport(DoubleSize(0, 50));
 
     setHeight(document().body(), 1100);
     EXPECT_EQ(document().getElementById("c")->layoutObject(),
@@ skipping 244 matching lines @@
         "<div id=c></div>"
         "<div id=d></div>");
 
     checkCorner("b", Corner::TopRight, DoublePoint(-20,  20),  DoubleSize(0, 0));
     checkCorner("a", Corner::TopRight, DoublePoint(-420, 20),  DoubleSize(400, 0));
     checkCorner("d", Corner::TopRight, DoublePoint(-20,  320), DoubleSize(0, -300));
     checkCorner("c", Corner::TopRight, DoublePoint(-420, 320), DoubleSize(400, -300));
 }
 
 }