Fix compositing chicken and egg problem in updateControlTints.

Source/core/frame/FrameView.cpp

Index: Source/core/frame/FrameView.cpp
diff --git a/Source/core/frame/FrameView.cpp b/Source/core/frame/FrameView.cpp
index bbf65c0fe63032ff03bb7fb97eb0ce714ecb0a49..14950cb6e07bd62937fa889d2ebbd1cb516d6b5b 100644
--- a/Source/core/frame/FrameView.cpp
+++ b/Source/core/frame/FrameView.cpp
@@ -2627,12 +2627,13 @@ void FrameView::updateControlTints()
 
     // FIXME: Why do we need this for hasCustomScrollbars?
     // FIXME: supportsControlTints is currently true for a bunch of platforms.
-    // It should only be for Mac 10.6.
     if (!RenderTheme::theme().supportsControlTints() && !hasCustomScrollbars())
         return;
 
-    if (needsLayout())
-        layout();
+    // Updating layout can run script, which can tear down the FrameView.
+    RefPtr<FrameView> protector(this);
+    updateLayoutAndStyleForPainting();
+
     // FIXME: The use of paint seems like overkill: crbug.com/236892
     GraphicsContext context(0); // NULL canvas to get a non-painting context.
     context.setUpdatingControlTints(true);
@@ -2778,6 +2779,16 @@ void FrameView::paintOverhangAreas(GraphicsContext* context, const IntRect& hori
     ScrollView::paintOverhangAreas(context, horizontalOverhangArea, verticalOverhangArea, dirtyRect);
 }
 
+void FrameView::updateLayoutAndStyleForPainting()
+{
+    // Updating layout can run script, which can tear down the FrameView.
+    RefPtr<FrameView> protector(this);
+
+    updateLayoutAndStyleIfNeededRecursive();
+    if (RenderView* view = renderView())
+        view->compositor()->updateCompositingLayers();
+}
+
 void FrameView::updateLayoutAndStyleIfNeededRecursive()
 {
     // We have to crawl our entire tree looking for any FrameViews that need