In case of frame flattening, when the child frame is re-starting the layout from the topmost parent, childframe needs RefPtr<FrameView> protector(this); so that it won't get destroyed by a recalcStyle() call in a parent layout(). fix: move RefPtr<FrameView> protector(this); in FrameView::layout() a few lines up, before the frame flattening re-start.
Created attachment 134088 [details] Patch
Comment on attachment 134088 [details] Patch Clearing flags on attachment: 134088 Committed r112283: <http://trac.webkit.org/changeset/112283>
All reviewed patches have been landed. Closing bug.