Make sure we don't try scrolling a node without a LayoutObject

third_party/WebKit/Source/core/input/ScrollManager.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/input/ScrollManager.h"
 
 #include "core/dom/DOMNodeIds.h"
 #include "core/events/GestureEvent.h"
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
@@ skipping 194 matching lines @@
   // If there's no layoutObject on the node, send the event to the nearest ancestor with a layoutObject.
   // Needed for <option> and <optgroup> elements so we can touch scroll <select>s
   while (m_scrollGestureHandlingNode &&
          !m_scrollGestureHandlingNode->layoutObject())
     m_scrollGestureHandlingNode =
         m_scrollGestureHandlingNode->parentOrShadowHostNode();
 
   if (!m_scrollGestureHandlingNode)
     m_scrollGestureHandlingNode = m_frame->document()->documentElement();
 
-  if (!m_scrollGestureHandlingNode)
+  if (!m_scrollGestureHandlingNode ||
+      !m_scrollGestureHandlingNode->layoutObject())
     return WebInputEventResult::NotHandled;
 
   passScrollGestureEventToWidget(gestureEvent,
                                  m_scrollGestureHandlingNode->layoutObject());
 
   m_currentScrollChain.clear();
   std::unique_ptr<ScrollStateData> scrollStateData =
       wrapUnique(new ScrollStateData());
   scrollStateData->position_x = gestureEvent.position().x();
   scrollStateData->position_y = gestureEvent.position().y();
   scrollStateData->is_beginning = true;
   scrollStateData->from_user_input = true;
   scrollStateData->is_direct_manipulation =
       gestureEvent.source() == PlatformGestureSourceTouchscreen;
   scrollStateData->delta_consumed_for_scroll_sequence =
       m_deltaConsumedForScrollSequence;
   ScrollState* scrollState = ScrollState::create(std::move(scrollStateData));
   customizedScroll(*m_scrollGestureHandlingNode.get(), *scrollState);
   return WebInputEventResult::HandledSystem;
 }
 
 WebInputEventResult ScrollManager::handleGestureScrollUpdate(
     const PlatformGestureEvent& gestureEvent) {
   DCHECK_EQ(gestureEvent.type(), PlatformEvent::GestureScrollUpdate);
 
+  Node* node = m_scrollGestureHandlingNode.get();
+  if (!node || !node->layoutObject())
+    return WebInputEventResult::NotHandled;
+
   // Negate the deltas since the gesture event stores finger movement and
   // scrolling occurs in the direction opposite the finger's movement
   // direction. e.g. Finger moving up has negative event delta but causes the
   // page to scroll down causing positive scroll delta.
   FloatSize delta(-gestureEvent.deltaX(), -gestureEvent.deltaY());
   FloatSize velocity(-gestureEvent.velocityX(), -gestureEvent.velocityY());
   FloatPoint position(gestureEvent.position());
 
   if (delta.isZero())
     return WebInputEventResult::NotHandled;
 
-  Node* node = m_scrollGestureHandlingNode.get();
-
-  if (!node)
-    return WebInputEventResult::NotHandled;
-
   LayoutObject* layoutObject = node->layoutObject();
-  if (!layoutObject)
-    return WebInputEventResult::NotHandled;
 
   // Try to send the event to the correct view.
   WebInputEventResult result =
       passScrollGestureEventToWidget(gestureEvent, layoutObject);
   if (result != WebInputEventResult::NotHandled) {
     // FIXME: we should allow simultaneous scrolling of nested
     // iframes along perpendicular axes. See crbug.com/466991.
     m_deltaConsumedForScrollSequence = true;
     return result;
   }
@@ skipping 45 matching lines @@
     return WebInputEventResult::HandledSystem;
   }
 
   return WebInputEventResult::NotHandled;
 }
 
 WebInputEventResult ScrollManager::handleGestureScrollEnd(
     const PlatformGestureEvent& gestureEvent) {
   Node* node = m_scrollGestureHandlingNode;
 
-  if (node) {
+  if (node && node->layoutObject()) {
     passScrollGestureEventToWidget(gestureEvent, node->layoutObject());
     std::unique_ptr<ScrollStateData> scrollStateData =
         wrapUnique(new ScrollStateData());
     scrollStateData->is_ending = true;
     scrollStateData->is_in_inertial_phase =
         gestureEvent.inertialPhase() == ScrollInertialPhaseMomentum;
     scrollStateData->from_user_input = true;
     scrollStateData->is_direct_manipulation =
         gestureEvent.source() == PlatformGestureSourceTouchscreen;
     scrollStateData->delta_consumed_for_scroll_sequence =
@@ skipping 196 matching lines @@
     if (scrollbar->gestureEvent(targetedEvent.event(), &shouldUpdateCapture)) {
       if (shouldUpdateCapture)
         m_scrollbarHandlingScrollGesture = scrollbar;
       return true;
     }
   }
   return false;
 }
 
 }  // namespace blink