Null-check PaintLayerScrollableArea lookup.

third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp

 /*
  * Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 2347 matching lines @@
 }
 
 bool CompositedLayerMapping::needsRepaint(const GraphicsLayer& graphicsLayer) const
 {
     return isScrollableAreaLayer(&graphicsLayer) ? true : m_owningLayer.needsRepaint();
 }
 
 void CompositedLayerMapping::adjustForCompositedScrolling(const GraphicsLayer* graphicsLayer, IntSize& offset) const
 {
     if (graphicsLayer == m_scrollingContentsLayer.get() || graphicsLayer == m_foregroundLayer.get()) {
-        DoubleSize adjustedScrollOffset = m_owningLayer.getScrollableArea()->adjustedScrollOffset();
-        offset.expand(-adjustedScrollOffset.width(), -adjustedScrollOffset.height());
+        if (m_owningLayer.getScrollableArea()) {
+            DoubleSize adjustedScrollOffset = m_owningLayer.getScrollableArea()->adjustedScrollOffset();
+            offset.expand(-adjustedScrollOffset.width(), -adjustedScrollOffset.height());
+        }
     }
 }
 
 void CompositedLayerMapping::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context,
     GraphicsLayerPaintingPhase graphicsLayerPaintingPhase, const IntRect& interestRect) const
 {
     // https://code.google.com/p/chromium/issues/detail?id=343772
     DisableCompositingQueryAsserts disabler;
     // Allow throttling to make sure no painting paths (e.g.,
     // ContentLayerDelegate::paintContents) try to paint throttled content.
@@ skipping 256 matching lines @@
     } else if (graphicsLayer == m_scrollingContentsLayer.get()) {
         name = "Scrolling Contents Layer";
     } else {
         ASSERT_NOT_REACHED();
     }
 
     return name;
 }
 
 } // namespace blink