tree 537cc33515ff40bc0656949509826b7e36919a13
parent c7932a5401fd950bacfb01a2d3f88999f36cb3f0
author David Bokan <bokan@chromium.org> 1549576652 +0000
committer Commit Bot <commit-bot@chromium.org> 1549576652 +0000

Fix nullptr scrollbar crash

Not sure how this can happen. ScrollbarsFor somehow returns a nullptr in
the ScrollbarSet. This must mean ToScrollbarLayer returns nullptr. This
method returns nullptr in the base and this in the
ScrollbarLayerImplBase override. Therefore the LayerToId muse be
returning a non-scrollbar layer.

The only time we add anything to element_id_to_scrollbar_layer_ids_
though is from LTI::RegisterScrollbar which is necessarily a scrollbar
layer. I think this means the Layer with the scrollbar layer's ID at
some point changes to a different layer. The ID-to-Layer mapping is
cleared when a layer is destroyed and the scrollbar layer clears the
element_id_to_scrollbar_layer_ids_ mapping in its destructor so I'm
speculating that we might be registering a new non-scrollbar layer with
the same id. I've converted the DCHECK to a CHECK at that location to
see if it comes back with any crashes from the wild.

Bug: 924068
Change-Id: I9bb15812aeda0a2c92d2547a52af9fbdbacc65b0
Reviewed-on: https://chromium-review.googlesource.com/c/1435686
Reviewed-by: Robert Flack <flackr@chromium.org>
Reviewed-by: David Bokan <bokan@chromium.org>
Commit-Queue: David Bokan <bokan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#630059}