ScrollingStateTree::rootStateNode() can be null when you are navigating between pages. There are two places in the code that don't null-check it, and I believe that those spots are responsible for some non-reproducible crashes that we have reports of. I believe this patch will fix https://bugs.webkit.org/show_bug.cgi?id=110509 which corresponds to <rdar://problem/12519348> and also <rdar://problem/13233090>. The offsets in those crashes do appear to be attempts at accessing setShouldUpdateScrollLayerPositionOnMainThread() and children() respectively on a null ScrollingStateNode.
Created attachment 189808 [details] Patch
Thanks! http://trac.webkit.org/changeset/143785
*** Bug 110509 has been marked as a duplicate of this bug. ***