Test that plug-ins cannot cause the NSView hierarchy to change beneath -[NSView _invalidateGStatesForTree].
To test, resize the browser window. Reload and repeat a few times. Each time you resize, the orange rectangle and its contents should vanish, and the browser should not crash.