Make sure we don't try scrolling a node without a LayoutObject

third_party/WebKit/Source/core/input/ScrollManager.cpp

Index: third_party/WebKit/Source/core/input/ScrollManager.cpp
diff --git a/third_party/WebKit/Source/core/input/ScrollManager.cpp b/third_party/WebKit/Source/core/input/ScrollManager.cpp
index 0f720e50cc0be53cb15c520582691be06c61a6ea..434949635f5412c94608a3f1aa914bb335ace0ce 100644
--- a/third_party/WebKit/Source/core/input/ScrollManager.cpp
+++ b/third_party/WebKit/Source/core/input/ScrollManager.cpp
@@ -212,7 +212,8 @@ WebInputEventResult ScrollManager::handleGestureScrollBegin(
   if (!m_scrollGestureHandlingNode)
     m_scrollGestureHandlingNode = m_frame->document()->documentElement();
 
-  if (!m_scrollGestureHandlingNode)
+  if (!m_scrollGestureHandlingNode ||
+      !m_scrollGestureHandlingNode->layoutObject())
     return WebInputEventResult::NotHandled;
 
   passScrollGestureEventToWidget(gestureEvent,
@@ -238,6 +239,10 @@ WebInputEventResult ScrollManager::handleGestureScrollUpdate(
     const PlatformGestureEvent& gestureEvent) {
   DCHECK_EQ(gestureEvent.type(), PlatformEvent::GestureScrollUpdate);
 
+  Node* node = m_scrollGestureHandlingNode.get();
+  if (!node || !node->layoutObject())
+    return WebInputEventResult::NotHandled;
+
   // Negate the deltas since the gesture event stores finger movement and
   // scrolling occurs in the direction opposite the finger's movement
   // direction. e.g. Finger moving up has negative event delta but causes the
@@ -249,14 +254,7 @@ WebInputEventResult ScrollManager::handleGestureScrollUpdate(
   if (delta.isZero())
     return WebInputEventResult::NotHandled;
 
-  Node* node = m_scrollGestureHandlingNode.get();
-
-  if (!node)
-    return WebInputEventResult::NotHandled;
-
   LayoutObject* layoutObject = node->layoutObject();
-  if (!layoutObject)
-    return WebInputEventResult::NotHandled;
 
   // Try to send the event to the correct view.
   WebInputEventResult result =
@@ -322,7 +320,7 @@ WebInputEventResult ScrollManager::handleGestureScrollEnd(
     const PlatformGestureEvent& gestureEvent) {
   Node* node = m_scrollGestureHandlingNode;
 
-  if (node) {
+  if (node && node->layoutObject()) {
     passScrollGestureEventToWidget(gestureEvent, node->layoutObject());
     std::unique_ptr<ScrollStateData> scrollStateData =
         wrapUnique(new ScrollStateData());