Fix crash on ASSERT when in subtree layout and LayoutState is not initialized

Source/core/frame/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 89 matching lines @@
         flags |= RenderLayer::NeedsFullRepaintInBacking;
     }
     if (isRelayoutingSubtree && layer->isPaginated())
         flags |= RenderLayer::UpdatePagination;
     return flags;
 }
 
 class FrameViewLayoutStateMaintainer {
     WTF_MAKE_NONCOPYABLE(FrameViewLayoutStateMaintainer);
 public:
-    FrameViewLayoutStateMaintainer(RenderObject& root)
+    FrameViewLayoutStateMaintainer(RenderObject& root, bool inSubtreeLayout)
         : m_view(*root.view())
-        , m_disabled(m_view.frameView()->isSubtreeLayout() && m_view.shouldDisableLayoutStateForSubtree(root))
+        , m_inSubtreeLayout(inSubtreeLayout)
+        , m_disabled(inSubtreeLayout && m_view.shouldDisableLayoutStateForSubtree(root))
     {
-        if (m_view.frameView()->isSubtreeLayout())
+        if (m_inSubtreeLayout)
             m_view.pushLayoutState(root);
         if (m_disabled)
             m_view.disableLayoutState();
     }
 
     ~FrameViewLayoutStateMaintainer()
     {
         if (m_disabled)
             m_view.enableLayoutState();
-        if (m_view.frameView()->isSubtreeLayout())
+        if (m_inSubtreeLayout)
             m_view.popLayoutState();
     }
 private:
     RenderView& m_view;
+    bool m_inSubtreeLayout;
     bool m_disabled;
 };
 
 FrameView::FrameView(LocalFrame* frame)
     : m_frame(frame)
     , m_canHaveScrollbars(true)
     , m_slowRepaintObjectCount(0)
     , m_hasPendingLayout(false)
     , m_layoutSubtreeRoot(0)
     , m_inSynchronousPostLayout(false)
@@ skipping 651 matching lines @@
 
     ASSERT(!isInPerformLayout());
     lifecycle().advanceTo(DocumentLifecycle::InPerformLayout);
 
     TemporaryChange<bool> changeInPerformLayout(m_inPerformLayout, true);
 
     // performLayout is the actual guts of layout().
     // FIXME: The 300 other lines in layout() probably belong in other helper functions
     // so that a single human could understand what layout() is actually doing.
 
-    FrameViewLayoutStateMaintainer statePusher(*rootForThisLayout);
+    FrameViewLayoutStateMaintainer statePusher(*rootForThisLayout, inSubtreeLayout);
     forceLayoutParentViewIfNeeded();
 
     {
         // Text Autosizing requires two-pass layout which is incompatible with partial layout.
         // If enabled, only do partial layout for the second layout.
         // FIXME (crbug.com/256657): Do not do two layouts for text autosizing.
         PartialLayoutDisabler partialLayoutDisabler(partialLayout(), m_frame->settings() && m_frame->settings()->textAutosizingEnabled());
         rootForThisLayout->layout();
         gatherDebugLayoutRects(rootForThisLayout);
 
@@ skipping 2382 matching lines @@
 void FrameView::willRemoveScrollbar(Scrollbar* scrollbar, ScrollbarOrientation orientation)
 {
     ScrollableArea::willRemoveScrollbar(scrollbar, orientation);
     if (AXObjectCache* cache = axObjectCache()) {
         cache->remove(scrollbar);
         cache->handleScrollbarUpdate(this);
     }
 }
 
 } // namespace WebCore