Fix crash when scrolling in a remote process frame

third_party/WebKit/Source/core/page/scrolling/RootScrollerController.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/page/scrolling/RootScrollerController.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/layout/LayoutBox.h"
 #include "core/paint/PaintLayerScrollableArea.h"
 #include "platform/graphics/GraphicsLayer.h"
 #include "platform/scroll/ScrollableArea.h"
 
 namespace blink {
 
 class RootFrameViewport;
 
 namespace {
 
 bool fillsViewport(const Element& element)
 {
     DCHECK(element.layoutObject());
     DCHECK(element.layoutObject()->isBox());
 
     LayoutObject* layoutObject = element.layoutObject();
 
-    // TODO(bokan): Broken for OOPIF.
+    // TODO(bokan): Broken for OOPIF. crbug.com/642378.
     Document& topDocument = element.document().topDocument();
 
     Vector<FloatQuad> quads;
     layoutObject->absoluteQuads(quads);
     DCHECK_EQ(quads.size(), 1u);
 
     if (!quads[0].isRectilinear())
         return false;
 
     LayoutRect boundingBox(quads[0].boundingBox());
@@ skipping 112 matching lines @@
     return nullptr;
 }
 
 bool RootScrollerController::isViewportScrollCallback(
     const ScrollStateCallback* callback) const
 {
     // TopDocumentRootScrollerController must override this method to actually
     // do the comparison.
     DCHECK(!m_document->isInMainFrame());
 
+    // If we don't have a local owner we must be in a remote iframe.
+    // RootScrollerController doesn't yet work in OOPIF and in any case we have
+    // no way to get at the ViewportScrollCallback so just return false.
+    // TODO(bokan): Make document.rootScroller work in OOPIF. crbug.com/642378.
+    if (!m_document->localOwner())
+        return false;
+
     RootScrollerController* topDocumentController =
         m_document->topDocument().rootScrollerController();
     return topDocumentController->isViewportScrollCallback(callback);
 }
 
 Element* RootScrollerController::defaultEffectiveRootScroller()
 {
     DCHECK(m_document);
     return m_document->documentElement();
 }
 
 } // namespace blink