Fix for crash in restoreScrollPositionAndViewState

From the stack trace in the bug, it looks like this function is entered during
DOMWindow teardown which means the dereference of the document() member on
the Frame is invalid. We can simply use m_frame->settings() since it's
guaranteed to be there because of the check for m_frame->page() at the
function's entrance.

BUG=377916

Review URL: https://codereview.chromium.org/326073007

git-svn-id: svn://svn.chromium.org/blink/trunk@175918 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/loader/FrameLoader.cpp

@@ -1035,7 +1035,7 @@ void FrameLoader::restoreScrollPositionAndViewState()
 
         m_frame->page()->setPageScaleFactor(m_currentItem->pageScaleFactor(), frameScrollOffset);
 
-        if (m_frame->document()->settings()->pinchVirtualViewportEnabled()) {
+        if (m_frame->settings()->pinchVirtualViewportEnabled()) {
             // If the pinch viewport's offset is (-1, -1) it means the history item
             // is an old version of HistoryItem so distribute the scroll between
             // the main frame and the pinch viewport as best as we can.