Fix ScrollingCoordinator-related crash with page popups

third_party/WebKit/Source/web/WebPagePopupImpl.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 377 matching lines @@
   } else {
     TRACE_EVENT0("blink",
                  "WebPagePopupImpl::setIsAcceleratedCompositingActive(true)");
 
     m_layerTreeView = m_widgetClient->initializeLayerTreeView();
     if (m_layerTreeView) {
       m_layerTreeView->setVisible(true);
       m_isAcceleratedCompositingActive = true;
       m_animationHost = WTF::makeUnique<CompositorAnimationHost>(
           m_layerTreeView->compositorAnimationHost());
-      m_page->layerTreeViewInitialized(*m_layerTreeView,
-                                       m_popupClient->ownerElement()
-                                           .document()
-                                           .frame()
-                                           ->localFrameRoot()
-                                           ->view());
+      m_page->layerTreeViewInitialized(*m_layerTreeView, nullptr);
     } else {
       m_isAcceleratedCompositingActive = false;
       m_animationHost = nullptr;
     }
   }
 }
 
 void WebPagePopupImpl::beginFrame(double lastFrameTimeMonotonic) {
   if (!m_page)
     return;
   // FIXME: This should use lastFrameTimeMonotonic but doing so
   // breaks tests.
   PageWidgetDelegate::animate(*m_page, monotonicallyIncreasingTime());
 }
 
 void WebPagePopupImpl::willCloseLayerTreeView() {
-  if (m_page && m_layerTreeView) {
-    m_page->willCloseLayerTreeView(*m_layerTreeView,
-                                   m_popupClient->ownerElement()
-                                       .document()
-                                       .frame()
-                                       ->localFrameRoot()
-                                       ->view());
-  }
+  if (m_page && m_layerTreeView)
+    m_page->willCloseLayerTreeView(*m_layerTreeView, nullptr);
 
   setIsAcceleratedCompositingActive(false);
   m_layerTreeView = nullptr;
   m_animationHost = nullptr;
 }
 
 void WebPagePopupImpl::updateAllLifecyclePhases() {
   if (!m_page)
     return;
   PageWidgetDelegate::updateAllLifecyclePhases(
@@ skipping 171 matching lines @@
   // A WebPagePopupImpl instance usually has two references.
   //  - One owned by the instance itself. It represents the visible widget.
   //  - One owned by a WebViewImpl. It's released when the WebViewImpl ask the
   //    WebPagePopupImpl to close.
   // We need them because the closing operation is asynchronous and the widget
   // can be closed while the WebViewImpl is unaware of it.
   return adoptRef(new WebPagePopupImpl(client)).leakRef();
 }
 
 }  // namespace blink