Fix for crash in restoreScrollPositionAndViewState

From the stack trace in the bug, it looks like this function is entered during
DOMWindow teardown which means the dereference of the document() member on
the Frame is invalid. We can simply use m_frame->settings() since it's
guaranteed to be there because of the check for m_frame->page() at the
function's entrance.

BUG=377916

Review URL: https://codereview.chromium.org/326073007

git-svn-id: svn://svn.chromium.org/blink/trunk@175918 bbb929c8-8fbe-4397-9dbb-9b2b20218538