Suspecting this CL from bisect, since it has to do with hit-testing https://chromium.googlesource.com/chromium/src/+/b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e

chrishtr@, could you please take a look?  It seems like your CL fixed crashes, so reverting might be risky, but you may know better.

Please add affected OSs.

This affects Mac (default OS preferences set to show scrollbars when scrolling).  When the "overlay-scrollbars" flag is enabled, I can also repro the issue on Linux 65.0.3312.0 and Windows 65.0.3311.3.

chrishtr@ This issue is marked as RB-Beta, could you please let us know is there any latest update available on this issue?

Thanks!

The root issue is that the new code can only avoid overlay scrollbars for
hit testing the non-scrollbar parts of the page for PaintLayers that have
overflow clipping.

Instead, a PaintLayer which is underneath overflow clipping and also underneath
the clipping root also needs to remove the area.

This is a little tricky, because these areas are not part of the paint
property trees - the clips there include the space overlay scrollbars, because
the painting use-case clips to an area that includes them.

https://chromium-review.googlesource.com/c/chromium/src/+/865776

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4267b4a05420c26baa8185183784ebfda9185615

commit 4267b4a05420c26baa8185183784ebfda9185615
Author: Chris Harrelson <chrishtr@chromium.org>
Date: Wed Jan 17 03:18:38 2018

Support clipping that excludes overlay scrollbars.

Hit testing sometimes wants to exclude overlay scrollbars from hit testing. This
requires a different set of clips than those that do not exclude these scrollbars. This
CL:

* Adds ClipRectExcludingOverlayScrollbars to ClipPaintPropertyNode
* Adds a mode in GeometryMapper to request clips that exclude overlay scrollbars
* Adjusts PaintLayerClipper to use the new mode

Previously, excluding overlay scrollbars was only supported for the root PaintLayer of
a hit testing context; now it is supported for intermediate overflow-scrolling areas.
In addition, the new code should have better clip caching behavior when overlay scrollbars
are present; when their presence changes, property trees (and the cache, by association)
are invalidated as appropriate.

Bug:  799150 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I23ea49dbbb63c6f6c8d640f69910fd03f2bb2107
Reviewed-on: https://chromium-review.googlesource.com/865776
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#529567}
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/core/paint/PaintLayerClipperTest.cpp
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilderTest.cpp
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/platform/graphics/compositing/CompositedLayerRasterInvalidatorTest.cpp
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/platform/graphics/compositing/PaintArtifactCompositorTest.cpp
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.cpp
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.h
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/platform/graphics/paint/GeometryMapper.cpp
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/platform/graphics/paint/GeometryMapper.h
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/platform/graphics/paint/GeometryMapperClipCache.h
[modify] https://crrev.com/4267b4a05420c26baa8185183784ebfda9185615/third_party/WebKit/Source/platform/graphics/paint/GeometryMapperTest.cpp

Verified on Canary channel.

[Auto-generated comment by a script] We noticed that this issue is targeted for M-65; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-65 label, otherwise remove Merge-TBD label. Thanks.