Check for the layoutObject before derefencing it.

content/browser/site_per_process_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/site_per_process_browsertest.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 5153 matching lines @@
                             ->root();
   ASSERT_EQ(1U, root->child_count());
   FrameTreeNode* mixed_child = root->child_at(0)->child_at(0);
   ASSERT_TRUE(mixed_child);
   // The child iframe attempted to create a mixed iframe; this should
   // have been blocked, so the mixed iframe should not have committed a
   // load.
   EXPECT_FALSE(mixed_child->has_committed_real_load());
 }
 
+// Test setting a cross-origin iframe to display: none.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, CrossSiteIframeDisplayNone) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  NavigateToURL(shell(), main_url);
+
+  // Set the iframe to display: none.
+  EXPECT_TRUE(
+      ExecuteScript(shell()->web_contents(),
+                    "document.querySelector('iframe').style.display = 'none'"));
+
+  // Waits until pending frames are done.
+  // TODO(lfg): We need to find a better way to wait on the renderer compositor
+  // frames.

[piman, 2016/01/29 01:07:50]

Agreed :)
Frames come via RenderWidgetHostViewBase::DidReceiveRendererFrame. Maybe we
could add a WaitForRendererFrameForTesting() there, that would do a nested loop
woken up in DidReceiveRendererFrame after renderer_frame_number_ is incremented?

[lfg, 2016/01/29 01:10:45]

The problem here is figuring out how many frames do I need to wait until the
renderer has finished rendering the first frame after the last javascript call.

I was thinking that maybe the renderer could read back the screen to force a
synchronization with the browser?

+  {
+    base::RunLoop run_loop;
+    base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+        FROM_HERE, run_loop.QuitClosure(),
+        base::TimeDelta::FromMilliseconds(1000));
+    run_loop.Run();
+  }
+
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
+  RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
+      root->current_frame_host()->GetRenderWidgetHost()->GetView());
+
+  unsigned current_frame_number = root_view->RendererFrameNumber();
+
+  // Force the renderer to generate a new frame.
+  EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
+                            "document.body.style.background = 'black'"));
+
+  // Waits for the next frame.
+  while (root_view->RendererFrameNumber() <= current_frame_number) {
+    base::RunLoop run_loop;
+    base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+        FROM_HERE, run_loop.QuitClosure(),
+        base::TimeDelta::FromMilliseconds(10));
+    run_loop.Run();
+  }
+}
+
 }  // namespace content