I landed additional instrumentation for Native Memory snapshot and found that sometimes native memory profiler traverses through a document from a previous test which is not yet collected. StyleResolver from this document has m_rootElementStyle member which points to an already deleted RenderStyle.
We don't believe this is possible in modern WebKit.