Freeze scrollbars for relayout if overflow:auto added scrollbars.

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 467 matching lines @@
 
     // Reset the flag here instead of in layoutInlineChildren() in case that
     // all inline children are removed from this block.
     setContainsInlineWithOutlineAndContinuation(false);
     if (childrenInline())
         layoutInlineChildren(relayoutChildren, afterEdge);
     else
         layoutBlockChildren(relayoutChildren, layoutScope, beforeEdge, afterEdge);
 
     bool preferredLogicalWidthsBecameDirty = !preferredLogicalWidthsWereDirty && preferredLogicalWidthsDirty();
-    if (preferredLogicalWidthsBecameDirty)
-        return false;
+    if (preferredLogicalWidthsBecameDirty) {
+        // The only thing that should dirty preferred widths at this point is the addition of
+        // overflow:auto scrollbars in a descendant.  To avoid a potential infinite loop,
+        // run layout again with auto scrollbars frozen in their current state.
+        PaintLayerScrollableArea::FreezeScrollbarsScope freezeScrollbars;
+        return layoutBlockFlow(relayoutChildren, pageLogicalHeight, layoutScope);
+    }
 
     // Expand our intrinsic height to encompass floats.
     if (lowestFloatLogicalBottom() > (logicalHeight() - afterEdge) && createsNewFormattingContext())
         setLogicalHeight(lowestFloatLogicalBottom() + afterEdge);
 
     if (LayoutMultiColumnFlowThread* flowThread = multiColumnFlowThread()) {
         if (flowThread->columnHeightsChanged()) {
             setChildNeedsLayout(MarkOnlyThis);
             return false;
         }
@@ skipping 3260 matching lines @@
 
     return LayoutBlock::invalidatePaintIfNeeded(paintInvalidationState);
 }
 
 void LayoutBlockFlow::invalidateDisplayItemClients(PaintInvalidationReason invalidationReason) const
 {
     BlockFlowPaintInvalidator(*this).invalidateDisplayItemClients(invalidationReason);
 }
 
 } // namespace blink