Check for the layoutObject before derefencing it.

third_party/WebKit/Source/web/WebRemoteFrameImpl.cpp

Index: third_party/WebKit/Source/web/WebRemoteFrameImpl.cpp
diff --git a/third_party/WebKit/Source/web/WebRemoteFrameImpl.cpp b/third_party/WebKit/Source/web/WebRemoteFrameImpl.cpp
index 4b3a445a01c05d3f66dd0178fc146da8c41dda6f..cdf397077fc1a1195b6948f291d2a648d0282428 100644
--- a/third_party/WebKit/Source/web/WebRemoteFrameImpl.cpp
+++ b/third_party/WebKit/Source/web/WebRemoteFrameImpl.cpp
@@ -813,7 +813,9 @@ void WebRemoteFrameImpl::didStopLoading()
 bool WebRemoteFrameImpl::isIgnoredForHitTest() const
 {
     HTMLFrameOwnerElement* owner = frame()->deprecatedLocalOwner();
-    return owner ? owner->layoutObject()->style()->pointerEvents() == PE_NONE : false;
+    if (!owner || !owner->layoutObject() || !owner->layoutObject()->style())

[dcheng, 2016/01/29 00:32:53]

Just for my understanding: when is LayoutObject::style() null?

[dcheng, 2016/01/29 00:35:35]

OK, per Elliot, there's no need to have a null check for style() here.

Since we're in a bit of a time crunch here to make canary, I'm going to dcommit
the fix without this null check.

[lfg, 2016/01/29 01:08:13]

Done.

+        return false;
+    return owner->layoutObject()->style()->pointerEvents() == PE_NONE;
 }
 
 WebRemoteFrameImpl::WebRemoteFrameImpl(WebTreeScopeType scope, WebRemoteFrameClient* client)