Sync'd ToT at refs/heads/master@{#498925}

Build on Linux with dcheck_always_on. Load ~/Downloads and scroll.
Observe crash.

[1:1:0901/132846.388167:FATAL:LayoutTable.h(599)] Check failed: !NeedsSectionRecalc(). 
#0 0x7f54cae051b7 base::debug::StackTrace::StackTrace()
#1 0x7f54cae2be21 logging::LogMessage::~LogMessage()
#2 0x7f54c3e76f74 blink::LayoutTable::TopNonEmptySection()
#3 0x7f54c3e7a7e3 blink::LayoutTable::ComputeCollapsedOuterBorderBefore()
#4 0x7f54c3e78646 blink::LayoutTable::BorderLeft()
#5 0x7f54c3df6521 blink::LayoutBox::NoOverflowRect()
#6 0x7f54c3ec3489 blink::RelativeBounds()
#7 0x7f54c3ec3055 blink::ScrollAnchor::Examine()
#8 0x7f54c3ec39cb blink::ScrollAnchor::FindAnchorRecursive()
#9 0x7f54c3ec3a34 blink::ScrollAnchor::FindAnchorRecursive()
#10 0x7f54c3ec3a34 blink::ScrollAnchor::FindAnchorRecursive()
#11 0x7f54c3ec3a34 blink::ScrollAnchor::FindAnchorRecursive()
#12 0x7f54c3ec380b blink::ScrollAnchor::FindAnchor()
#13 0x7f54c3ec3df8 blink::ScrollAnchor::NotifyBeforeLayout()
#14 0x7f54c3a17188 blink::LocalFrameView::PerformPreLayoutTasks()
#15 0x7f54c3a14787 blink::LocalFrameView::UpdateLayout()
#16 0x7f54c3a24bdf blink::LocalFrameView::UpdateStyleAndLayoutIfNeededRecursiveInternal()
#17 0x7f54c3a22a27 blink::LocalFrameView::UpdateStyleAndLayoutIfNeededRecursive()
#18 0x7f54c3a21499 blink::LocalFrameView::UpdateLifecyclePhasesInternal()
#19 0x7f54c3a212c3 blink::LocalFrameView::UpdateAllLifecyclePhases()
#20 0x7f54c4005d8a blink::PageAnimator::UpdateAllLifecyclePhases()
#21 0x7f54c39c290d blink::WebViewImpl::UpdateAllLifecyclePhases()
#22 0x7f54c889cf6e content::RenderWidget::UpdateVisualState()
#23 0x7f54c760a9d1 cc::ProxyMain::BeginMainFrame()
#24 0x7f54c760939f _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIMN2cc9ProxyMainEFvNSt3__110unique_ptrINS4_28BeginMainFrameAndCommitStateENS6_14default_deleteIS8_EEEEENS_7WeakPtrIS5_EEJSB_EEEvOT_OT0_DpOT1_
#25 0x7f54c7609283 _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvNSt3__110unique_ptrINS3_28BeginMainFrameAndCommitStateENS5_14default_deleteIS7_EEEEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperISA_EEEEEFvvEE7RunOnceEPNS0_13BindStateBaseE
#26 0x7f54cae05a29 base::debug::TaskAnnotator::RunTask()
#27 0x7f54c294a46c blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#28 0x7f54c2948004 blink::scheduler::TaskQueueManager::DoWork()
#29 0x7f54c294c1f2 _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE3RunEPNS0_13BindStateBaseE
#30 0x7f54cae05a29 base::debug::TaskAnnotator::RunTask()
#31 0x7f54cae3809d base::MessageLoop::RunTask()
#32 0x7f54cae3880f base::MessageLoop::DoWork()
#33 0x7f54cae3a190 base::MessagePumpDefault::Run()
#34 0x7f54cae37b3a base::MessageLoop::Run()
#35 0x7f54cae6b987 base::RunLoop::Run()
#36 0x7f54c88aac8f content::RendererMain()
#37 0x7f54c8a29674 content::RunZygote()
#38 0x7f54c8a29f61 content::RunNamedProcessTypeMain()
#39 0x7f54c8a2a9d0 content::ContentMainRunnerImpl::Run()
#40 0x7f54cb34f2d0 service_manager::Main()
#41 0x7f54c8a29322 content::ContentMain()
#42 0x562ec3a33303 ChromeMain
#43 0x7f54be40bf45 __libc_start_main
#44 0x562ec3a3314f <unknown>