Code: gfx::Vector2d LayerTreeHost::DistributeScrollOffsetToViewports(
    const gfx::Vector2d offset,
    Layer* layer) {
  DCHECK(layer);
  if (layer != outer_viewport_scroll_layer_.get())
    return offset;
  gfx::Vector2d inner_viewport_offset =
      inner_viewport_scroll_layer_->scroll_offset();
  gfx::Vector2d outer_viewport_offset =
      outer_viewport_scroll_layer_->scroll_offset();
  if (offset == inner_viewport_offset + outer_viewport_offset) {
    return outer_viewport_offset;
  }
  gfx::Vector2d max_outer_viewport_scroll_offset =
      outer_viewport_scroll_layer_->MaxScrollOffset();
  gfx::Vector2d max_inner_viewport_scroll_offset =
      inner_viewport_scroll_layer_->MaxScrollOffset();
  outer_viewport_offset = offset - inner_viewport_offset;
  outer_viewport_offset.SetToMin(max_outer_viewport_scroll_offset);
  outer_viewport_offset.SetToMax(gfx::Vector2d());
  inner_viewport_offset = offset - outer_viewport_offset;
  inner_viewport_offset.SetToMin(max_inner_viewport_scroll_offset);
  inner_viewport_offset.SetToMax(gfx::Vector2d());
  inner_viewport_scroll_layer_->SetScrollOffset(inner_viewport_offset);
  return outer_viewport_offset;
}

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in the XSLT ProcessingInstruction implementation in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an applyXSLTransform call involving (1) an HTML document or (2) an xsl:processing-instruction element that is still in the process of loading.
Commit Message: Removed pinch viewport scroll offset distribution

The associated change in Blink makes the pinch viewport a proper
ScrollableArea meaning the normal path for synchronizing layer scroll
offsets is used.

This is a 2 sided patch, the other CL:
https://codereview.chromium.org/199253002/

BUG=349941

Review URL: https://codereview.chromium.org/210543002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@260105 0039d316-1c4b-4281-b951-d872f2087c98