Don't call into ScrollView from Scrollbar.

Source/core/rendering/RenderLayerScrollableArea.cpp

Index: Source/core/rendering/RenderLayerScrollableArea.cpp
diff --git a/Source/core/rendering/RenderLayerScrollableArea.cpp b/Source/core/rendering/RenderLayerScrollableArea.cpp
index d5ba03a633bf3881c315a8f3d19516e7f4c4015f..b9eef7f2d72736bac2d9046fd0630279e0a89d2e 100644
--- a/Source/core/rendering/RenderLayerScrollableArea.cpp
+++ b/Source/core/rendering/RenderLayerScrollableArea.cpp
@@ -880,7 +880,7 @@ void RenderLayerScrollableArea::destroyScrollbar(ScrollbarOrientation orientatio
     if (!scrollbar->isCustomScrollbar())
         willRemoveScrollbar(scrollbar.get(), orientation);
 
-    scrollbar->removeFromParent();
+    toScrollView(scrollbar->parent())->removeChild(scrollbar.get());

[Ian Vollick, 2014/10/04 01:25:44]

The fact that we were in RenderLayerScrollableArea but the scrollbar's parent is
a ScrollView kinda blew my mind a bit. It took a bit too long, but I think I
understand it. Please let me know if I've got this right.

First, this matches the code in removeToParent (always a good sign), but we know
that it's safe to call toScrollView here because at the end of
RenderLayerScrollableArea::createScrollbar, we add newly created scrollbar
widget as a child of box().document().view() which is a FrameView and therefore
a non-NULL ScrollView?

[skobes, 2014/10/06 18:18:53]

Yes, exactly right. :)

     scrollbar->disconnectFromScrollableArea();
     scrollbar = nullptr;
 }