Prevent markContainerChainForLayout to scheduleRelayout() if isInPerformLayout()

third_party/WebKit/Source/core/layout/LayoutObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index a8d5d0ac97e786501b826f6565b2c950f175126e..de7715c257b6c677470c7ebe94ce04b8d8523d03 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -765,7 +765,12 @@ void LayoutObject::markContainerChainForLayout(bool scheduleRelayout, SubtreeLay
 {
     ASSERT(!isSetNeedsLayoutForbidden());
     ASSERT(!layouter || this != layouter->root());
-    ASSERT(!scheduleRelayout || !layouter);
+    // When we're in layout, we're marking a descendant as needing layout with
+    // the intention of visiting it during this layout. We shouldn't be
+    // scheduling it to be laid out later.
+    // Also, scheduleRelayout() must not be called while iterating
+    // FrameView::m_layoutSubtreeRootList.
+    scheduleRelayout &= !frameView()->isInPerformLayout();
 
     LayoutObject* object = container();
     LayoutObject* last = this;