Detach PaintLayerScrollableArea from RootFrameViewport when disposed.

third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@gmail.com>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 34 matching lines @@
 
 #include "core/css/PseudoStyleRequest.h"
 #include "core/dom/AXObjectCache.h"
 #include "core/dom/DOMNodeIds.h"
 #include "core/dom/Node.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/editing/FrameSelection.h"
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
+#include "core/frame/RootFrameViewport.h"
 #include "core/frame/Settings.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/input/EventHandler.h"
 #include "core/layout/LayoutFlexibleBox.h"
 #include "core/layout/LayoutPart.h"
 #include "core/layout/LayoutScrollbar.h"
 #include "core/layout/LayoutScrollbarPart.h"
 #include "core/layout/LayoutTheme.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/compositing/CompositedLayerMapping.h"
 #include "core/layout/compositing/PaintLayerCompositor.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "core/page/ChromeClient.h"
 #include "core/page/FocusController.h"
 #include "core/page/Page.h"
+#include "core/page/scrolling/RootScrollerController.h"
 #include "core/page/scrolling/ScrollingCoordinator.h"
 #include "core/paint/PaintLayerFragment.h"
 #include "platform/PlatformGestureEvent.h"
 #include "platform/PlatformMouseEvent.h"
 #include "platform/graphics/CompositorMutableProperties.h"
 #include "platform/graphics/GraphicsLayer.h"
 #include "platform/graphics/paint/DrawingRecorder.h"
 #include "platform/scroll/ScrollAnimatorBase.h"
 #include "platform/scroll/ScrollbarTheme.h"
 #include "public/platform/Platform.h"
@@ skipping 69 matching lines @@
         // FIXME: Make setSavedLayerScrollOffset take DoubleSize. crbug.com/414283.
         if (node && node->isElementNode())
             toElement(node)->setSavedLayerScrollOffset(flooredIntSize(m_scrollOffset));
     }
 
     if (LocalFrame* frame = box().frame()) {
         if (FrameView* frameView = frame->view())
             frameView->removeResizerArea(box());
     }
 
+    if (RootScrollerController* controller = box().document().rootScrollerController())
+        controller->didDisposePaintLayerScrollableArea(*this);
+
     m_scrollbarManager.dispose();
 
     if (m_scrollCorner)
         m_scrollCorner->destroy();
     if (m_resizer)
         m_resizer->destroy();
 
     clearScrollAnimators();
 
     // Note: it is not safe to call ScrollAnchor::clear if the document is being destroyed,
@@ skipping 1599 matching lines @@
 
 void PaintLayerScrollableArea::DelayScrollPositionClampScope::clampScrollableAreas()
 {
     for (auto& scrollableArea : *s_needsClamp)
         scrollableArea->clampScrollPositionsAfterLayout();
     delete s_needsClamp;
     s_needsClamp = nullptr;
 }
 
 } // namespace blink