Regression(r129944): Heap-use-after-free in WebCore::computeNonFastScrollableRegion
https://bugs.webkit.org/show_bug.cgi?id=99515

Reviewed by Simon Fraser.

The object used-after-freed is a destructed FrameView that is still in the m_scrollableAreas set of the parent FrameView. Actually it has been removed from m_scrollableAreas when setParent(0), but then is added back in updateScrollableAreaSet() because its frameViewParent() is still not 0 (though parent() is already 0).

No new tests. The heap-use-after-free doesn't always cause crash so it can't be stably tested with a test case. Memory analysis tools like asan discovered the heap-use-after-free and verified that the patch can fix the issue.

* page/FrameView.cpp:
(WebCore::FrameView::parentFrameView): Checks if the FrameView has been removed from the parent.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139365 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Layout Test svg/dom/SVGScriptElement/script-onerror-bubbling.svg is a flaky timeout on all platforms.
https://bugs.webkit.org/show_bug.cgi?id=106598

* platform/chromium/TestExpectations: Expectatized.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139366 268f45cc-cd09-0410-ab3c-d52691b4dbfc