Check for the layoutObject before derefencing it.

third_party/WebKit/Source/web/WebRemoteFrameImpl.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "web/WebRemoteFrameImpl.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/Settings.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/layout/LayoutObject.h"
@@ skipping 795 matching lines @@
     if (parent() && parent()->isWebLocalFrame()) {
         WebLocalFrameImpl* parentFrame =
             toWebLocalFrameImpl(parent()->toWebLocalFrame());
         parentFrame->frame()->loader().checkCompleted();
     }
 }
 
 bool WebRemoteFrameImpl::isIgnoredForHitTest() const
 {
     HTMLFrameOwnerElement* owner = frame()->deprecatedLocalOwner();
-    return owner ? owner->layoutObject()->style()->pointerEvents() == PE_NONE : false;
+    if (!owner || !owner->layoutObject() || !owner->layoutObject()->style())

[dcheng, 2016/01/29 00:32:53]

Just for my understanding: when is LayoutObject::style() null?

[dcheng, 2016/01/29 00:35:35]

OK, per Elliot, there's no need to have a null check for style() here.

Since we're in a bit of a time crunch here to make canary, I'm going to dcommit
the fix without this null check.

[lfg, 2016/01/29 01:08:13]

Done.

+        return false;
+    return owner->layoutObject()->style()->pointerEvents() == PE_NONE;
 }
 
 WebRemoteFrameImpl::WebRemoteFrameImpl(WebTreeScopeType scope, WebRemoteFrameClient* client)
     : WebRemoteFrame(scope)
     , m_frameClient(RemoteFrameClientImpl::create(this))
     , m_client(client)
 #if ENABLE(OILPAN)
     , m_selfKeepAlive(this)
 #endif
 {
 }
 
 } // namespace blink