Adjust workaround for crash bug to move up the stack.

third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights
  * reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
@@ skipping 263 matching lines @@
   rectToMap.moveBy(-context.rootLayer->layoutObject()->paintOffset());
 }
 
 void PaintLayerClipper::calculateRectsWithGeometryMapper(
     const ClipRectsContext& context,
     const LayoutRect& paintDirtyRect,
     LayoutRect& layerBounds,
     ClipRect& backgroundRect,
     ClipRect& foregroundRect,
     const LayoutPoint* offsetFromRoot) const {
-  backgroundRect = clipRectWithGeometryMapper(context, false);
-  applyOverflowClipToBackgroundRectWithGeometryMapper(context, backgroundRect);
+  const auto* properties = m_layer.layoutObject()->paintProperties();
+  // TODO(chrishtr): fix the underlying bug that causes this situation.
+  if (!properties) {
+    backgroundRect = ClipRect(LayoutRect(LayoutRect::infiniteIntRect()));
+    foregroundRect = ClipRect(LayoutRect(LayoutRect::infiniteIntRect()));
+  } else {
+    backgroundRect = clipRectWithGeometryMapper(context, false);
+    applyOverflowClipToBackgroundRectWithGeometryMapper(context,
+                                                        backgroundRect);
 
-  backgroundRect.move(
-      context.subPixelAccumulation);  // TODO(chrishtr): is this needed?
-  backgroundRect.intersect(paintDirtyRect);
+    backgroundRect.move(
+        context.subPixelAccumulation);  // TODO(chrishtr): is this needed?
+    backgroundRect.intersect(paintDirtyRect);
 
-  foregroundRect.move(
-      context.subPixelAccumulation);  // TODO(chrishtr): is this needed?
-  foregroundRect = clipRectWithGeometryMapper(context, true);
-  foregroundRect.intersect(paintDirtyRect);
+    foregroundRect.move(
+        context.subPixelAccumulation);  // TODO(chrishtr): is this needed?
+    foregroundRect = clipRectWithGeometryMapper(context, true);
+    foregroundRect.intersect(paintDirtyRect);
+  }
   LayoutPoint offset;
   if (offsetFromRoot)
     offset = *offsetFromRoot;
   else
     m_layer.convertToLayerCoords(context.rootLayer, offset);
   layerBounds = LayoutRect(offset, LayoutSize(m_layer.size()));
 
 #ifdef CHECK_CLIP_RECTS
   ClipRect testBackgroundRect, testForegroundRect;
   LayoutRect testLayerBounds;
@@ skipping 126 matching lines @@
 
   return parentRects.overflowClipRect();
 }
 
 ClipRect PaintLayerClipper::clipRectWithGeometryMapper(
     const ClipRectsContext& context,
     bool isForeground) const {
   DCHECK(m_geometryMapper);
   LayoutRect source(LayoutRect::infiniteIntRect());
   const auto* properties = m_layer.layoutObject()->paintProperties();
   // TODO(chrishtr): fix the underlying bug that causes this situation.

[pdr., 2017/02/14 19:26:45]

This guy got left behind

-  if (!properties)
-    return ClipRect(source);
   DCHECK(properties && properties->localBorderBoxProperties());
 
   PropertyTreeState propertyTreeState = *properties->localBorderBoxProperties();
   const auto* ancestorProperties =
       context.rootLayer->layoutObject()->paintProperties();
   DCHECK(ancestorProperties && ancestorProperties->localBorderBoxProperties());
   PropertyTreeState destinationPropertyTreeState =
       *ancestorProperties->localBorderBoxProperties();
 
   if (&m_layer == context.rootLayer) {
@@ skipping 124 matching lines @@
     const LayoutSize& subpixelAccumulation) const {
   DCHECK(!m_geometryMapper);
   ClipRectsContext context(rootLayer, PaintingClipRects,
                            IgnoreOverlayScrollbarSize, subpixelAccumulation);
   if (respectOverflowClip == IgnoreOverflowClip)
     context.setIgnoreOverflowClip();
   return getClipRects(context);
 }
 
 }  // namespace blink