bokan@: how does this bug manifest in practice with OOPIFs?  Is scrolling going to be broken in some cases?  I noticed the pointer to this bug on the OOPIF-unfriendly topDocument() use in fillsViewport().

The use of topDocument is pretty innocuous. If we're in an OOPIF, it'll just return the wrong dimensions for the root frame and so we may or may not set the root scroller when we normally wouldn't. (rather than crash or break scrolling).

More generally, document.rootScroller doesn't yet work across process boundaries. This means that trying to set an element in an OOPIF to be the rootScroller won't work. I haven't tried it with OOPIFs yet so I'm not sure how it breaks but this is a new proposal and is behind a flag, I've specifically decided to punt on making it work with OOPIF for now since its unclear when or what form this might eventually ship in. 

https://github.com/bokand/NonDocumentRootScroller/blob/master/explainer.md for details on the proposal itself.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a0f8775417a4b36578e04318b2f4d9a42beed9ed

commit a0f8775417a4b36578e04318b2f4d9a42beed9ed
Author: David Bokan <bokan@chromium.org>
Date: Tue Jan 23 15:32:42 2018

Fix root layer scrolls crash in viewport registration

The crash would occur when a non-main frame finished its lifecycle
update before the main frame. This can happen in an OOPIF as lifecycle
on local roots is independent. This would kick the viewport layer
registration method while the main frame hadn't yet completed
compositing, leading to a CanQueryCompositingState DCHECK. This occured
only when root-layer-scrolls is turned on because, without it, the
container and scrolling layers would be the layers created by the
PaintLayerCompositor (unless the test/page sets a rootScroller) which
live outside the document lifecycle.

This patch fixes the issue by only reregistering viewport layers after
a compositing update on the frame that contains the global root
scroller. This guarantees that we're in the correct lifecycle state.

Bug:  800566 , 642378
Change-Id: Ibbaa77b7f40794f16cecdaec46353dd00bc277e9
Reviewed-on: https://chromium-review.googlesource.com/877338
Reviewed-by: Steve Kobes <skobes@chromium.org>
Commit-Queue: David Bokan <bokan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531243}
[modify] https://crrev.com/a0f8775417a4b36578e04318b2f4d9a42beed9ed/third_party/WebKit/Source/core/frame/LocalFrameView.cpp
[modify] https://crrev.com/a0f8775417a4b36578e04318b2f4d9a42beed9ed/third_party/WebKit/Source/core/page/scrolling/RootScrollerTest.cpp
[modify] https://crrev.com/a0f8775417a4b36578e04318b2f4d9a42beed9ed/third_party/WebKit/Source/core/page/scrolling/TopDocumentRootScrollerController.cpp
[modify] https://crrev.com/a0f8775417a4b36578e04318b2f4d9a42beed9ed/third_party/WebKit/Source/core/page/scrolling/TopDocumentRootScrollerController.h