chromium/third_party/blink/web_tests/fast/events/touch/gesture/gesture-scroll-object-crash.html

<!DOCTYPE html>
<script src="../../../../resources/testharness.js"></script>
<script src="../../../../resources/testharnessreport.js"></script>
<script src="../../../../resources/gesture-util.js"></script>
<style>
#spacer {
  height: 1000px;
}
#target {
  width: 50px;
  height: 50px;
}
</style>
<object id=target></object>
<div id=spacer></div>

<script>
// This promise gets resolved in the event handler.
var scrollHandlerResolve;
scrollHandlerPromise = new Promise(function(resolve) {
  scrollHandlerResolve = resolve;
});

window.addEventListener('scroll', function(e) {
    scrollHandlerResolve();
});

promise_test (async () => {
    var target = document.getElementById('target');
    var rect = target.getBoundingClientRect();
    var targetX = rect.left + rect.width / 2;
    var targetY = rect.top + rect.height / 2;
    await smoothScroll(20, targetX, targetY, GestureSourceType.TOUCH_INPUT,
                      "down", SPEED_INSTANT);
    await waitFor( () => { return document.scrollingElement.scrollTop > 0; });
    await scrollHandlerPromise;
}, "Verifies that scrolling on top of a LayoutEmbeddedContent with null " +
   "widget works and doesn't crash.");
</script>