The Sources panel implements a virtual viewport by updating "top" on the relative-positioned child of the .CodeMirror-sizer element, which holds all the lines.  SANACLAP should be all over this.

Unfortunately we clear the SANACLAP bit in LayoutObject::clearNeedsLayout, which is too soon for flexbox craziness.  It's already cleared by the time ~DelayScrollPositionClampScope runs ScrollAnchor::restore (deferred by r412450).

Fix will be a bit messy, but tractable.

-----
( SET SANACLAP on child of .CodeMirror-sizer )
( outer DSPCS for LayoutFlexibleBox (positioned) DIV class='widget vbox root-view'
  ( layout .CodeMirror-scroll
    ( CLEAR SANACLAP on child of .CodeMirror-sizer )
  )
  ( layout .CodeMirror-scroll )
  ( perform -299 adjustment for scroller LayoutBlockFlow (relative positioned) DIV class='CodeMirror-scroll'
    ( [1] adjust by -299 for LayoutBlockFlow (relative positioned) DIV )
  )
)
-----

This might be a good time to reconsider whether we can just adjust at frame boundaries instead of in the middle of layout. It would fix this bug in a very general way, reduce the overall amount of work we need to do, and arguably make the developer experience more predictable.

Slight correction: the state of the LayoutObject's SANACLAP bit at the time of ScrollAnchor::restore is irrelevant.  The problem is the *second* layout's call to ScrollAnchor::save, which probably shouldn't even happen.

-----
( SET SANACLAP on child of .CodeMirror-sizer )
( outer DSPCS for LayoutFlexibleBox (positioned) DIV class='widget vbox root-view'
  ( layout .CodeMirror-scroll
    ( save for .CodeMirror-scroll, SANACLAP == 1 )
    ( CLEAR SANACLAP on child of .CodeMirror-sizer )
  )
  ( layout .CodeMirror-scroll
    ( save for .CodeMirror-scroll, SANACLAP == 0 )
  )
  ( restore: perform -299 adjustment for anchor LayoutBlockFlow (relative positioned) DIV
    ( [3] adjust by -299 for LayoutBlockFlow (relative positioned) DIV )
  )
)
-----

@3: Yes, we should think about that. :)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4217fd09fbd83f49bfa33288311192a1ef067361

commit 4217fd09fbd83f49bfa33288311192a1ef067361
Author: skobes <skobes@chromium.org>
Date: Fri Sep 02 00:28:02 2016

Ignore redundant calls to ScrollAnchor::save.

Flex scrollers go through LayoutBlock::layout multiple times; we call save()
every time, but make only one call to restore() when we exit the outermost
DelayScrollPositionClampScope (see http://crrev.com/412450).

The second save() cleared ScrollAnchor::m_scrollAnchorDisablingStyleChanged,
because the first layout had cleared the corresponding LayoutObject bit.

BUG= 641815 

Review-Url: https://codereview.chromium.org/2304493002
Cr-Commit-Position: refs/heads/master@{#416143}

[modify] https://crrev.com/4217fd09fbd83f49bfa33288311192a1ef067361/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
[modify] https://crrev.com/4217fd09fbd83f49bfa33288311192a1ef067361/third_party/WebKit/Source/core/layout/ScrollAnchor.h
[modify] https://crrev.com/4217fd09fbd83f49bfa33288311192a1ef067361/third_party/WebKit/Source/core/layout/ScrollAnchorTest.cpp