In case of frame flattening, when the child frame is re-starting the layout from the topmost parent, childframe needs RefPtr<FrameView> protector(this); so that it won't get destroyed by a recalcStyle() call in a parent layout().
fix: move RefPtr<FrameView> protector(this); in FrameView::layout() a few lines up, before the frame flattening re-start.
Created attachment 134088 [details]
Comment on attachment 134088 [details]
Clearing flags on attachment: 134088
Committed r112283: <http://trac.webkit.org/changeset/112283>
All reviewed patches have been landed. Closing bug.