Fix null pointer dereference in PLSA's scrollbarStyleSource.

third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights
  * reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@gmail.com>
@@ skipping 1131 matching lines @@
       if (docElement && docElement->layoutObject() &&
           docElement->layoutObject()->style()->hasPseudoStyle(
               PseudoIdScrollbar))
         return *docElement->layoutObject();
     }
 
     if (layoutObject.styleRef().hasPseudoStyle(PseudoIdScrollbar))
       return layoutObject;
 
     if (ShadowRoot* shadowRoot = node->containingShadowRoot()) {
-      if (shadowRoot->type() == ShadowRootType::UserAgent)
-        return *shadowRoot->host().layoutObject();
+      if (shadowRoot->type() == ShadowRootType::UserAgent) {
+        if (LayoutObject* hostLayoutObject = shadowRoot->host().layoutObject())
+          return *hostLayoutObject;
+      }
     }
   }
 
   return layoutObject;
 }
 
 bool PaintLayerScrollableArea::needsScrollbarReconstruction() const {
   const LayoutObject& styleSource = scrollbarStyleSource(box());
   bool shouldUseCustom =
       styleSource.isBox() &&
@@ skipping 966 matching lines @@
 
 void PaintLayerScrollableArea::DelayScrollOffsetClampScope::
     clampScrollableAreas() {
   for (auto& scrollableArea : *s_needsClamp)
     scrollableArea->clampScrollOffsetAfterOverflowChange();
   delete s_needsClamp;
   s_needsClamp = nullptr;
 }
 
 }  // namespace blink