Don't restore in LayoutBlock::layout if clamping is delayed.

third_party/WebKit/Source/core/layout/LayoutBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 362 matching lines @@
     // layoutBlock().
     layoutBlock(false);
 
     // It's safe to check for control clip here, since controls can never be table cells.
     // If we have a lightweight clip, there can never be any overflow from children.
     if (hasControlClip() && m_overflow)
         clearLayoutOverflow();
 
     invalidateBackgroundObscurationStatus();
 
-    if (needsScrollAnchoring)
+    // If clamping is delayed, we will restore in PaintLayerScrollableArea::clampScrollPositionsAfterLayout.
+    // Restoring during the intermediate layout may clamp the scroller to the wrong bounds.
+    bool clampingDelayed = PaintLayerScrollableArea::DelayScrollPositionClampScope::clampingIsDelayed();
+    if (needsScrollAnchoring && !clampingDelayed)
         getScrollableArea()->scrollAnchor().restore();
 
     m_heightAvailableToChildrenChanged = false;
 }
 
 bool LayoutBlock::widthAvailableToChildrenHasChanged()
 {
     // TODO(robhogan): Does m_widthAvailableToChildrenChanged always get reset when it needs to?
     bool widthAvailableToChildrenHasChanged = m_widthAvailableToChildrenChanged;
     m_widthAvailableToChildrenChanged = false;
@@ skipping 1473 matching lines @@
         for (TrackedLayoutBoxListHashSet::const_iterator it = positionedDescendantSet->begin(); it != end; ++it) {
             LayoutBox* currBox = *it;
             ASSERT(!currBox->needsLayout());
         }
     }
 }
 
 #endif
 
 } // namespace blink