Fix unscrollable scrollers after closing a <dialog>.

third_party/WebKit/Source/core/html/HTMLDialogElement.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 15 matching lines @@
 #include "core/html/HTMLDialogElement.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/dom/AXObjectCache.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/NodeTraversal.h"
 #include "core/events/Event.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/UseCounter.h"
 #include "core/html/HTMLFormControlElement.h"
+#include "core/layout/LayoutView.h"
 #include "core/style/ComputedStyle.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 // This function chooses the focused element when show() or showModal() is
 // invoked, as described in their spec.
 static void setFocusForDialog(HTMLDialogElement* dialog) {
   Element* focusableDescendant = 0;
@@ skipping 63 matching lines @@
   closeDialog(returnValue);
 }
 
 void HTMLDialogElement::closeDialog(const String& returnValue) {
   if (!fastHasAttribute(openAttr))
     return;
   setBooleanAttribute(openAttr, false);
 
   HTMLDialogElement* activeModalDialog = document().activeModalDialog();
   document().removeFromTopLayer(this);
-  if (activeModalDialog == this)
+  if (activeModalDialog == this) {
     inertSubtreesChanged(document());
+    // Any scrollers that were laid out when we were shown need to be laid out
+    // again now to keep FrameView::m_scrollableAreas up to date. To that end,
+    // force normal layout instead of simplified layout on the document.
+    // See crbug.com/633520 for details.
+    document().layoutView()->setNeedsLayout(

[esprehn, 2016/10/15 08:38:46]

This should be in the top layer management code, not inside dialog. Anything
inside too layer will manifest similar bugs since they become kids of the
LayoutView. It's also very strange for the DOM to explicitly  mark layout dirty,
that generally means something is broken at a deeper level in the system.

+        LayoutInvalidationReason::ChildChanged);
+  }
 
   if (!returnValue.isNull())
     m_returnValue = returnValue;
 
   scheduleCloseEvent();
 }
 
 void HTMLDialogElement::forceLayoutForCentering() {
   m_centeringMode = NeedsCentering;
   document().updateStyleAndLayoutIgnorePendingStylesheets();
@@ skipping 75 matching lines @@
 void HTMLDialogElement::defaultEventHandler(Event* event) {
   if (event->type() == EventTypeNames::cancel) {
     closeDialog();
     event->setDefaultHandled();
     return;
   }
   HTMLElement::defaultEventHandler(event);
 }
 
 }  // namespace blink