Check for the layoutObject before derefencing it.

content/browser/site_per_process_browsertest.cc

Index: content/browser/site_per_process_browsertest.cc
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index f7a373bf91f7284225a1415645c91295e53e3bad..834ed55943a3ddf6a2a3185821304c20cd036bdf 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -5171,4 +5171,48 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessIgnoreCertErrorsBrowserTest,
   EXPECT_FALSE(mixed_child->has_committed_real_load());
 }
 
+// Test setting a cross-origin iframe to display: none.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, CrossSiteIframeDisplayNone) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  NavigateToURL(shell(), main_url);
+
+  // Set the iframe to display: none.
+  EXPECT_TRUE(
+      ExecuteScript(shell()->web_contents(),
+                    "document.querySelector('iframe').style.display = 'none'"));
+
+  // Waits until pending frames are done.
+  // TODO(lfg): We need to find a better way to wait on the renderer compositor
+  // frames.

[piman, 2016/01/29 01:07:50]

Agreed :)
Frames come via RenderWidgetHostViewBase::DidReceiveRendererFrame. Maybe we
could add a WaitForRendererFrameForTesting() there, that would do a nested loop
woken up in DidReceiveRendererFrame after renderer_frame_number_ is incremented?

[lfg, 2016/01/29 01:10:45]

The problem here is figuring out how many frames do I need to wait until the
renderer has finished rendering the first frame after the last javascript call.

I was thinking that maybe the renderer could read back the screen to force a
synchronization with the browser?

+  {
+    base::RunLoop run_loop;
+    base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+        FROM_HERE, run_loop.QuitClosure(),
+        base::TimeDelta::FromMilliseconds(1000));
+    run_loop.Run();
+  }
+
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
+  RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
+      root->current_frame_host()->GetRenderWidgetHost()->GetView());
+
+  unsigned current_frame_number = root_view->RendererFrameNumber();
+
+  // Force the renderer to generate a new frame.
+  EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
+                            "document.body.style.background = 'black'"));
+
+  // Waits for the next frame.
+  while (root_view->RendererFrameNumber() <= current_frame_number) {
+    base::RunLoop run_loop;
+    base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+        FROM_HERE, run_loop.QuitClosure(),
+        base::TimeDelta::FromMilliseconds(10));
+    run_loop.Run();
+  }
+}
+
 }  // namespace content