Check null m_parent in PaintLayer::insertOnlyThisLayerAfterStyleChange()

third_party/WebKit/Source/core/paint/PaintLayer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 1318 matching lines @@
     // paint invalidation container.
     bool didSetPaintInvalidation = false;
     if (!RuntimeEnabledFeatures::slimmingPaintV2Enabled() && !layoutObject()->isLayoutView() && layoutObject()->isRooted() && layoutObject()->styleRef().isStacked()) {
         const LayoutBoxModelObject& previousPaintInvalidationContainer = layoutObject()->parent()->containerForPaintInvalidation();
         if (!previousPaintInvalidationContainer.styleRef().isStackingContext()) {
             layoutObject()->invalidatePaintIncludingNonSelfPaintingLayerDescendants(previousPaintInvalidationContainer);
             didSetPaintInvalidation = true;
         }
     }
 
-    if (!didSetPaintInvalidation && isSelfPaintingLayer()) {
+    if (!didSetPaintInvalidation && isSelfPaintingLayer() && m_parent) {
         if (PaintLayer* enclosingSelfPaintingLayer = m_parent->enclosingSelfPaintingLayer())
             mergeNeedsPaintPhaseFlagsFrom(*enclosingSelfPaintingLayer);
     }
 
     // Clear out all the clip rects.
     clipper().clearClipRectsIncludingDescendants();
 }
 
 // Returns the layer reached on the walk up towards the ancestor.
 static inline const PaintLayer* accumulateOffsetTowardsAncestor(const PaintLayer* layer, const PaintLayer* ancestorLayer, LayoutPoint& location)
@@ skipping 1583 matching lines @@
 
 void showLayerTree(const blink::LayoutObject* layoutObject)
 {
     if (!layoutObject) {
         fprintf(stderr, "Cannot showLayerTree. Root is (nil)\n");
         return;
     }
     showLayerTree(layoutObject->enclosingLayer());
 }
 #endif