tree f1199aff363e4b2e5523e8fbf20bcbaa9e1ed9d7
parent e5949eddbb44d20052682bbfeb3f83374f36db8f
author inferno@chromium.org <inferno@chromium.org@bbb929c8-8fbe-4397-9dbb-9b2b20218538> 1370798076 +0000
committer inferno@chromium.org <inferno@chromium.org@bbb929c8-8fbe-4397-9dbb-9b2b20218538> 1370798076 +0000

Uptake WebKit Changeset r149185.

Object elements have the tendency to modify or even fully remove
the containing Document inside beforeload callback. While Document is removed,
RenderArena gets destroyed. Retained RenderWidgets fails to function with NULL arena.
Protect RendereArena from getting wiped out, when Document is removed
during FrameView::updateWidget().
BUG=226696

Review URL: https://chromiumcodereview.appspot.com/16695002

git-svn-id: svn://svn.chromium.org/blink/trunk@152086 bbb929c8-8fbe-4397-9dbb-9b2b20218538