Fix crash in FrameView::updateLayersAndCompositingAfterScrollIfNeeded

third_party/WebKit/Source/core/frame/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 1956 matching lines @@
 
   // Update sticky position objects which are stuck to the viewport. In order to
   // correctly compute the sticky position offsets the layers must be visited
   // top-down, so start at the 'root' sticky elements and recurse downwards.
   for (const auto& viewportConstrainedObject : *m_viewportConstrainedObjects) {
     LayoutObject* layoutObject = viewportConstrainedObject;
     if (layoutObject->style()->position() != EPosition::kSticky)
       continue;
 
     PaintLayer* layer = toLayoutBoxModelObject(layoutObject)->layer();
+
+    // This method can be called during layout at which point the ancestor
+    // overflow layer may not be set yet. We can safely skip such cases as we
+    // will revisit this method during compositing inputs update.
+    if (!layer->ancestorOverflowLayer())
+      continue;
+
     StickyConstraintsMap constraintsMap = layer->ancestorOverflowLayer()
                                               ->getScrollableArea()
                                               ->stickyConstraintsMap();
     if (constraintsMap.contains(layer) &&
         !constraintsMap.at(layer).hasAncestorStickyElement()) {
       // TODO(skobes): Resolve circular dependency between scroll offset and
       // compositing state, and remove this disabler. https://crbug.com/420741
       DisableCompositingQueryAsserts disabler;
       layer->updateLayerPositionsAfterOverflowScroll();
       layoutObject->setMayNeedPaintInvalidationSubtree();
@@ skipping 3225 matching lines @@
 void FrameView::setAnimationHost(
     std::unique_ptr<CompositorAnimationHost> host) {
   m_animationHost = std::move(host);
 }
 
 LayoutUnit FrameView::caretWidth() const {
   return LayoutUnit(getHostWindow()->windowToViewportScalar(1));
 }
 
 }  // namespace blink