Merge 142788. Requested by Christian Biesinger <cbiesinger@chromium.org>.

Merge 142788. Requested by Christian Biesinger <cbiesinger@chromium.org>;.
> Crash when encountering <object style="resize:both;">
> https://bugs.webkit.org/show_bug.cgi?id=109728
> 
> Source/WebCore:
> 
> See also https://code.google.com/p/chromium/issues/detail?id=175535
> This bug can be reproduced on
> http://dramalink.net/tudou.y/?xink=162601060
> 
> Patch by Christian Biesinger <cbiesinger@chromium.org>; on 2013-02-13
> Reviewed by Eric Seidel.
> 
> Test: fast/css/resize-object-crash.html
> 
> * rendering/RenderWidget.cpp:
> (WebCore::RenderWidget::paint):
> Only call paintResizer() if we have a layer and canResize() is true
> 
> LayoutTests:
> 
> See also https://code.google.com/p/chromium/issues/detail?id=175535
> 
> Patch by Christian Biesinger <cbiesinger@chromium.org>; on 2013-02-13
> Reviewed by Eric Seidel.
> 
> * fast/css/resize-object-crash-expected.txt: Added.
> * fast/css/resize-object-crash.html: Added.

TBR=commit-queue@webkit.org
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=142920