What steps will reproduce the problem?
(1) Run chrome with --enable-blink-gen-property-trees
(2) open devtools
(3) Do any mouse of the enter/move/leave on the Elements panel.

What is the expected result?
No crash should happen.

What happens instead?
The page crashes after the third step, here is an example stack trace:

#0 0x7f38dc4dfb5c base::debug::StackTrace::StackTrace()
#1 0x7f38dc4df631 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f38d0f920c0 <unknown>
#3 0x7f38cd6a1b47 cc::draw_property_utils::LayerShouldBeSkippedForDrawPropertiesComputation()
#4 0x7f38cd6a1c1d cc::draw_property_utils::FindLayersThatNeedUpdates()
#5 0x7f38cd6b10f4 cc::LayerTreeHost::DoUpdateLayers()
#6 0x7f38cd6b07d7 cc::LayerTreeHost::UpdateLayers()
#7 0x7f38cd706a1f cc::ProxyMain::BeginMainFrame()
#8 0x7f38cd7050df _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIMN2cc9ProxyMainEFvNSt3__110unique_ptrINS4_28BeginMainFrameAndCommitStateENS6_14default_deleteIS8_EEEEENS_7WeakPtrIS5_EEJSB_EEEvOT_OT0_DpOT1_
#9 0x7f38cd704fae _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvNSt3__110unique_ptrINS3_28BeginMainFrameAndCommitStateENS5_14default_deleteIS7_EEEEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperISA_EEEEEFvvEE7RunOnceEPNS0_13BindStateBaseE
#10 0x7f38dc409f40 base::debug::TaskAnnotator::RunTask()
#11 0x7f38d2d3c66d base::sequence_manager::internal::ThreadControllerImpl::DoWork()
#12 0x7f38d2d3e618 _ZN4base8internal7InvokerINS0_9BindStateIMNS_16sequence_manager8internal20ThreadControllerImplEFvNS5_8WorkTypeEEJNS_7WeakPtrIS5_EES6_EEEFvvEE3RunEPNS0_13BindStateBaseE
#13 0x7f38dc409f40 base::debug::TaskAnnotator::RunTask()
#14 0x7f38dc435c76 base::internal::IncomingTaskQueue::RunTask()
#15 0x7f38dc439a57 base::MessageLoop::RunTask()
#16 0x7f38dc439e6a base::MessageLoop::DeferOrRunPendingTask()
#17 0x7f38dc43a0fe base::MessageLoop::DoWork()
#18 0x7f38dc43c456 base::MessagePumpDefault::Run()
#19 0x7f38dc439381 base::MessageLoop::Run()
#20 0x7f38dc46c9b6 base::RunLoop::Run()
#21 0x7f38da2c00d5 content::RendererMain()
#22 0x7f38da39c115 content::RunZygote()
#23 0x7f38da39ca70 content::RunOtherNamedProcessTypeMain()
#24 0x7f38da39d740 content::ContentMainRunnerImpl::Run()
#25 0x7f38dc7516bf service_manager::Main()
#26 0x7f38da39b5a4 content::ContentMain()
#27 0x55bcb79581b3 ChromeMain
#28 0x7f38cee132b1 __libc_start_main
#29 0x55bcb795802a _start
  r8: 00007fffa30ade70  r9: 00007fffa30add80 r10: 00356d10b04c35cb r11: 0000000000000246
 r12: 00003ef3b307b8d0 r13: 0000000000000000 r14: 00003ef3b307b958 r15: 00003ef3b3081700
  di: 00003ef3b3081700  si: 00003ef3b307b8d0  bp: 00007fffa30ade80  bx: 00000000ffffffff
  dx: 00003ef3b307b958  ax: 0000000000000001  cx: 0000000000000000  sp: 00007fffa30add20
  ip: 00007f38cd6a1b47 efl: 0000000000010246 cgf: 002b000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 000000000000012c
[end of stack trace]