Defer call to updateWidgetPositions() outside of RenderLayerScrollableArea.

Source/core/rendering/RenderLayerScrollableArea.cpp

Index: Source/core/rendering/RenderLayerScrollableArea.cpp
diff --git a/Source/core/rendering/RenderLayerScrollableArea.cpp b/Source/core/rendering/RenderLayerScrollableArea.cpp
index 4aa079b9eded30fb30ffa7ec2ef3beb5ff2902c5..d6a56bf0a5bb016c8732d23fbfd53dbcb809a82d 100644
--- a/Source/core/rendering/RenderLayerScrollableArea.cpp
+++ b/Source/core/rendering/RenderLayerScrollableArea.cpp
@@ -366,10 +366,7 @@ void RenderLayerScrollableArea::setScrollOffset(const IntPoint& newScrollOffset)
         box().setPreviousPaintInvalidationRect(box().boundsRectForPaintInvalidation(paintInvalidationContainer));
         // Update regions, scrolling may change the clip of a particular region.
         frameView->updateAnnotatedRegions();
-        // FIXME: We shouldn't call updateWidgetPositions() here since it might tear down the render tree,
-        // for now we just crash to avoid allowing an attacker to use after free.
-        frameView->updateWidgetPositions();
-        RELEASE_ASSERT(frameView->renderView());

[hartmanng, 2014/08/20 15:33:10]

I don't think this RELEASE_ASSERT is necessary anymore - it was added to try to
deal with this use-after-free (see https://codereview.chromium.org/132913002 and
the deleted comment above)

+        frameView->setNeedsUpdateWidgetPositions();
         updateCompositingLayersAfterScroll();
     }