Dispose of RootFrameViewport's ScrollAnimator during FrameView::dispose

ScrollAnimators are held from objects which are not garbage collected. When
FrameView is disposed, it clears its ScrollAnimators so we don't make calls into
the disposed FrameView via these non-GC'd objects. However, we weren't clearing
the RootFrameViewport's ScrollAnimators. This meant that the FrameView gets
disposed but the OS in Mac will make a call to ScrollAnimatorMac which in turn
makes a call into its RootFrameViewport which calls into the disposed FrameView
causing a use-after-free when the FrameView touches a deleted PaintLayer.

Since the root FrameView owns the RootFrameViewport, it makes sense to clear its
animators at the same time.

BUG=582755

Review URL: https://codereview.chromium.org/1756273003

Cr-Commit-Position: refs/heads/master@{#380135}

0 files changed, 0 insertions, 0 deletions