Make sure we don't try scrolling a node without a LayoutObject

third_party/WebKit/Source/web/tests/WebFrameTest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 10147 matching lines @@
   helper.initializeAndLoad(url, true);
   Platform::current()->getURLLoaderMockFactory()->setLoaderDelegate(nullptr);
 
   Document* document =
       toLocalFrame(helper.webView()->page()->mainFrame())->document();
   EXPECT_TRUE(document->isImageDocument());
   EXPECT_EQ(Resource::DecodeError,
             toImageDocument(document)->cachedImage()->getStatus());
 }
 
+// Load a page with display:none set and try to scroll it. It shouldn't crash
+// due to lack of layoutObject. crbug.com/653327.
+TEST_F(WebFrameTest, ScrollBeforeLayoutDoesntCrash) {
+  registerMockedHttpURLLoad("display-none.html");
+  FrameTestHelpers::WebViewHelper webViewHelper;
+  webViewHelper.initializeAndLoad(m_baseURL + "display-none.html");
+  WebViewImpl* webView = webViewHelper.webView();
+  webViewHelper.resize(WebSize(640, 480));
+
+  Document* document = webView->mainFrameImpl()->frame()->document();
+  document->documentElement()->setLayoutObject(nullptr);
+
+  WebGestureEvent beginEvent;
+  beginEvent.type = WebInputEvent::GestureScrollEnd;
+  beginEvent.sourceDevice = WebGestureDeviceTouchpad;
+  WebGestureEvent updateEvent;
+  updateEvent.type = WebInputEvent::GestureScrollEnd;
+  updateEvent.sourceDevice = WebGestureDeviceTouchpad;
+  WebGestureEvent endEvent;
+  endEvent.type = WebInputEvent::GestureScrollEnd;
+  endEvent.sourceDevice = WebGestureDeviceTouchpad;
+
+  // Try GestureScrollEnd and GestureScrollUpdate first to make sure that not
+  // seeing a Begin first doesn't break anything. (This currently happens).
+  webViewHelper.webView()->handleInputEvent(endEvent);
+  webViewHelper.webView()->handleInputEvent(updateEvent);
+
+  // Try a full Begin/Update/End cycle.
+  webViewHelper.webView()->handleInputEvent(beginEvent);
+  webViewHelper.webView()->handleInputEvent(updateEvent);
+  webViewHelper.webView()->handleInputEvent(endEvent);
+}
+
 }  // namespace blink