I'm not going to revert the culprit because it's too large.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/629fe08ea841eda1ee1d1c0caa99ad4b3154603b

commit 629fe08ea841eda1ee1d1c0caa99ad4b3154603b
Author: Yutaka Hirano <yhirano@chromium.org>
Date: Mon Dec 10 03:32:30 2018

[Sheriffing] Mark some layout tests as flaky

NOTRY=True
TBR=pdr@chromium.org

Bug: 913170, 913173
Change-Id: I009929ad4d1977bf20a2247e4aec1962a6592004
Reviewed-on: https://chromium-review.googlesource.com/c/1369486
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#615037}
[modify] https://crrev.com/629fe08ea841eda1ee1d1c0caa99ad4b3154603b/third_party/blink/web_tests/TestExpectations

I debugged this a bit and found it's due to crrev.com/610494: Reland "[BlinkGenPropertyTrees] Associate each cc::KeyframeModel with ElementId"

It looks like we have colliding element ids. I think this is because elements_in_property_trees is added to in two codepaths (LayerTreeHost::RegisterElement and LayerTreeHost::SetActiveRegisteredElementIds).

To reproduce:
Uncomment the compositing/layer-creation/fixed-position-in-fixed-overflow.html line in TestExpectations.
[run webkit tests] compositing/layer-creation/fixed-position-in-fixed-overflow.html --no-retry-failures --iterations=10

Here's a stacktrace with a little bit of debugging in case it's helpful:
STDERR: VERBOSE3:layer_tree_host.cc(334)] before pushing layer properties:
STDERR: VERBOSE3:layer_tree_host.cc(335)] current layer tree:
STDERR: INFO:layer_tree_host.cc(337)]   layer[16] with element id (0)
STDERR: INFO:layer_tree_host.cc(337)]   layer[2] with element id (0)
STDERR: INFO:layer_tree_host.cc(337)]   layer[3] with element id (16)
STDERR: INFO:layer_tree_host.cc(337)]   layer[4] with element id (18)
STDERR: INFO:layer_tree_host.cc(337)]   layer[13] with element id (160)
STDERR: INFO:layer_tree_host.cc(337)]   layer[15] with element id (162)
STDERR: INFO:layer_tree_host.cc(337)]   layer[17] with element id (192)
STDERR: INFO:layer_tree_host.cc(337)]   layer[23] with element id (194)
STDERR: INFO:layer_tree_host.cc(337)]   layer[18] with element id (208)
STDERR: INFO:layer_tree_host.cc(337)]   layer[20] with element id (3113)
STDERR: VERBOSE3:layer_tree_host.cc(339)] current layer tree impl:
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[16] with element id (0)
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[2] with element id (0)
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[3] with element id (16)
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[4] with element id (18)
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[13] with element id (160)
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[15] with element id (162)
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[17] with element id (192)
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[23] with element id (0)
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[18] with element id (208)
STDERR: INFO:layer_tree_host.cc(341)]   layer_impl[20] with element id (0)
STDERR: INFO:layer_tree_impl.cc(639)] element_id_collision_detected: (3113)
STDERR: INFO:layer_tree_impl.cc(640)] elements_in_property_trees counts right before collision:
STDERR: INFO:layer_tree_impl.cc(642)]   element id (3113): 1
STDERR: INFO:layer_tree_impl.cc(642)]   element id (16): 1
STDERR: INFO:layer_tree_impl.cc(642)]   element id (27): 1
STDERR: INFO:layer_tree_impl.cc(642)]   element id (162): 1
STDERR: INFO:layer_tree_impl.cc(642)]   element id (18): 1
STDERR: FATAL:layer_tree_impl.cc(645)] Check failed: !element_id_collision_detected. 
STDERR: 0   libbase.dylib                       0x00000001104d5863 base::debug::StackTrace::StackTrace(unsigned long) + 83
STDERR: 1   libbase.dylib                       0x00000001104d591d base::debug::StackTrace::StackTrace(unsigned long) + 29
STDERR: 2   libbase.dylib                       0x00000001101beaba base::debug::StackTrace::StackTrace() + 26
STDERR: 3   libbase.dylib                       0x000000011020643e logging::LogMessage::~LogMessage() + 142
STDERR: 4   libbase.dylib                       0x0000000110205235 logging::LogMessage::~LogMessage() + 21
STDERR: 5   libcc.dylib                         0x000000013098a9db cc::LayerTreeImpl::AddToElementLayerList(cc::ElementId, cc::LayerImpl*) + 1211
STDERR: 6   libcc.dylib                         0x000000013073ab29 cc::LayerImpl::SetElementId(cc::ElementId) + 377
STDERR: 7   libcc.dylib                         0x000000013072896a cc::Layer::PushPropertiesTo(cc::LayerImpl*) + 426
STDERR: 8   libcc.dylib                         0x0000000130750594 cc::PaintedScrollbarLayer::PushPropertiesTo(cc::LayerImpl*) + 68
STDERR: 9   libcc.dylib                         0x0000000130a39694 void cc::PushLayerPropertiesInternal<std::__1::__wrap_iter<cc::Layer**> >(std::__1::__wrap_iter<cc::Layer**>, std::__1::__wrap_iter<cc::Layer**>, cc::LayerTreeImpl*) + 324
STDERR: 10  libcc.dylib                         0x0000000130a39493 cc::TreeSynchronizer::PushLayerProperties(cc::LayerTreeHost*, cc::LayerTreeImpl*) + 307
STDERR: 11  libcc.dylib                         0x00000001308fcabe cc::LayerTreeHost::FinishCommitOnImplThread(cc::LayerTreeHostImpl*) + 2542
STDERR: 12  libcc.dylib                         0x0000000130a2e8d7 cc::SingleThreadProxy::DoCommit() + 647

Thanks for the details. I'll try to have a look at this soon. Off the top of my head I few thoughts:

1) Probably simplest, we only add to elements_in_property_trees_ from SetActiveRegisteredElementIds when in layer list mode. If we do this before setting element ids on layers we could even assert that they were already counted for.
2) If the scrollable ElementIds are separate from the ones for property tree nodes (i.e. different namespaces), we could ensure that element ids for scrollers are only registered on the RegisterElement path.
3) Alternately, we could change it to only worry about collisions resulting from registered elements (i.e. non-null LayerImpl*), in theory the element should be added to and removed from both at the same time.

I'm thinking #1 makes the most sense and is simplest.