Fix for crash in restoreScrollPositionAndViewState

Fix for crash in restoreScrollPositionAndViewState

From the stack trace in the bug, it looks like this function is entered during
DOMWindow teardown which means the dereference of the document() member on
the Frame is invalid. We can simply use m_frame->settings() since it's
guaranteed to be there because of the check for m_frame->page() at the
function's entrance.

BUG=377916
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=175918

[bokan, 2014-06-10 19:31:00]

Levi, ptal. I couldn't get a repro (and thus, test) and it looks like it might
be tricky to get one, but this looks like a pretty clear-cut NULL deref.

[Nate Chapin, 2014-06-10 19:34:28]

Do we know where/how is the DOMWindow getting nulled out? I agree this change
makes sense. I'm just curious where the detach is occurring, since it's not
anywhere obvious on the stack.

[bokan, 2014-06-10 19:56:30]

On 2014/06/10 19:34:28, Nate Chapin wrote:
> Do we know where/how is the DOMWindow getting nulled out? I agree this change
> makes sense. I'm just curious where the detach is occurring, since it's not
> anywhere obvious on the stack.

The V8 stuff goes well over my head, my best guess is in
V8WindowShell::clearForNavigation
(https://code.google.com/p/chromium/codesearch/#chromium/src/third_party/WebKi...).
It looks like it cleans up some Document-like object, but I'm not sure how V8 is
tied to the Blink objects so maybe that's not it.

[Nate Chapin, 2014-06-10 20:00:23]

On 2014/06/10 19:56:30, bokan wrote:
> On 2014/06/10 19:34:28, Nate Chapin wrote:
> > Do we know where/how is the DOMWindow getting nulled out? I agree this
change
> > makes sense. I'm just curious where the detach is occurring, since it's not
> > anywhere obvious on the stack.
> 
> The V8 stuff goes well over my head, my best guess is in
> V8WindowShell::clearForNavigation
>
(https://code.google.com/p/chromium/codesearch/#chromium/src/third_party/WebKi...).
> It looks like it cleans up some Document-like object, but I'm not sure how V8
is
> tied to the Blink objects so maybe that's not it.

Aaah, yeah. I didn't scroll far enough down to realize this was a nested run
loop. LGTM. In a perfect world we'd have a test, but that's often difficult with
nested run loops.

[bokan, 2014-06-10 20:24:36]

The CQ bit was checked by bokan@chromium.org

[commit-bot: I haz the power, 2014-06-10 20:24:59]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/bokan@chromium.org/326073007/1

[leviw_travelin_and_unemployed, 2014-06-10 20:29:02]

lgtm as well

[commit-bot: I haz the power, 2014-06-10 21:31:50]

Change committed as 175918