Detach PaintLayerScrollableArea from RootFrameViewport when disposed.

third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp

Index: third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
index ab70822b20994b38efc5be6a20d2a373e360672f..f572ff2bcfa033518902f60fc776a7b44a1cd743 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
@@ -52,6 +52,7 @@
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
+#include "core/frame/RootFrameViewport.h"
 #include "core/frame/Settings.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/input/EventHandler.h"
@@ -67,6 +68,7 @@
 #include "core/page/ChromeClient.h"
 #include "core/page/FocusController.h"
 #include "core/page/Page.h"
+#include "core/page/scrolling/RootScrollerController.h"
 #include "core/page/scrolling/ScrollingCoordinator.h"
 #include "core/paint/PaintLayerFragment.h"
 #include "platform/PlatformGestureEvent.h"
@@ -156,6 +158,9 @@ void PaintLayerScrollableArea::dispose()
             frameView->removeResizerArea(box());
     }
 
+    if (RootScrollerController* controller = box().document().rootScrollerController())
+        controller->didDisposePaintLayerScrollableArea(*this);
+
     m_scrollbarManager.dispose();
 
     if (m_scrollCorner)