with permission security enabled, a page with nested layout generates null pointer exception under the condition that a portlet in the inner most nested layout is denied access.
For example: a page with root layout as oneColumnNoAction, inside this layout, this are portletA and a TwoColumnNoAction layout. under the TwoColumnNoAction, portletB at the left cell, and a OneColumn layout at the right cell. inside the OneColumn layout positioned portletC. if portletC is forbidden from the current user, while portletA and portletB are OK to see. Null pointer is thrown.
In general, if all portlets (suppose more than one) under the OneColumn layout are blocked to the current user, Null Pointer error is thrown. To make null pointer go away, at least one potlet inside the inner most layout (OneColumn layout) has to be accessible to user. Another point to note is that, if the inner most layout (OneColumn layout) has no portlet fragment at all (means no <fragment type='portlet' .../>. the page is displayed correctly (i.e. only portletA and portletB apepar on the page, which theoritically should be the same for the display situation, from user point of view, when portletC is forbidden). Theory is that JS2 treats those two situations differently somehow.