Fix for crash in restoreScrollPositionAndViewState

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 1017 matching lines @@
     bool canRestoreWithoutAnnoyingUser = !view->wasScrolledByUser() && (canRestoreWithoutClamping || m_state == FrameStateComplete);
     if (!canRestoreWithoutAnnoyingUser)
         return;
 
     if (m_frame->isMainFrame() && m_currentItem->pageScaleFactor()) {
         FloatPoint pinchViewportOffset(m_currentItem->pinchViewportScrollPoint());
         IntPoint frameScrollOffset(m_currentItem->scrollPoint());
 
         m_frame->page()->setPageScaleFactor(m_currentItem->pageScaleFactor(), frameScrollOffset);
 
-        if (m_frame->document()->settings()->pinchVirtualViewportEnabled()) {
+        if (m_frame->settings()->pinchVirtualViewportEnabled()) {
             // If the pinch viewport's offset is (-1, -1) it means the history item
             // is an old version of HistoryItem so distribute the scroll between
             // the main frame and the pinch viewport as best as we can.
             // FIXME(bokan): This legacy distribution can be removed once the virtual viewport
             // pinch path is enabled on all platforms for at least one release.
             if (pinchViewportOffset.x() == -1 && pinchViewportOffset.y() == -1)
                 pinchViewportOffset = FloatPoint(frameScrollOffset - view->scrollPosition());
 
             m_frame->host()->pinchViewport().setLocation(pinchViewportOffset);
         }
@@ skipping 420 matching lines @@
     // FIXME: We need a way to propagate sandbox flags to out-of-process frames.
     Frame* parentFrame = m_frame->tree().parent();
     if (parentFrame && parentFrame->isLocalFrame())
         flags |= toLocalFrame(parentFrame)->document()->sandboxFlags();
     if (FrameOwner* frameOwner = m_frame->owner())
         flags |= frameOwner->sandboxFlags();
     return flags;
 }
 
 } // namespace WebCore