Merge 105250 - Source/WebCore: Crash in FrameView::forceLayoutParentViewIfNeeded.

Source/WebCore/page/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 883 matching lines @@
         return;
 
     RenderBox* contentBox = embeddedContentBox();
     if (!contentBox)
         return;
 
     RenderSVGRoot* svgRoot = toRenderSVGRoot(contentBox);
     if (!svgRoot->needsSizeNegotiationWithHostDocument())
         return;
 
+    RefPtr<FrameView> frameView = ownerRenderer->frame()->view();
+
     ASSERT(!m_inLayoutParentView);
     TemporarilyChange<bool> resetInLayoutParentView(m_inLayoutParentView, true);
 
     // Clear needs-size-negotiation flag in RenderSVGRoot, so the next call to our
     // layout() method won't fire the size negotiation logic again.
     svgRoot->scheduledSizeNegotiationWithHostDocument();
     ASSERT(!svgRoot->needsSizeNegotiationWithHostDocument());
 
     // Mark the owner renderer as needing layout.
     ownerRenderer->setNeedsLayoutAndPrefWidthsRecalc();
 
     // Immediately relayout the child widgets, which can now calculate the SVG documents
     // intrinsic size, negotiating with the parent object/embed/iframe.
     RenderView* rootView = ownerRenderer->frame()->contentRenderer();
     ASSERT(rootView);
     rootView->updateWidgetPositions();
 
     // Synchronously enter layout, to layout the view containing the host object/embed/iframe.
-    FrameView* frameView = ownerRenderer->frame()->view();
     ASSERT(frameView);
     frameView->layout();
 #endif
 }
 
 void FrameView::layout(bool allowSubtree)
 {
     if (m_inLayout)
         return;
 
@@ skipping 2360 matching lines @@
 }
     
 AXObjectCache* FrameView::axObjectCache() const
 {
     if (frame() && frame()->document() && frame()->document()->axObjectCacheExists())
         return frame()->document()->axObjectCache();
     return 0;
 }
     
 } // namespace WebCore