blob: be423677de52f5ad51e3058ee648b6c28bdf96f2 [file] [log] [blame]
<head>
<script>
if (testRunner)
testRunner.dumpAsText();
function test()
{
document.body.offsetTop;
var s = document.getElementById("target").style;
s.setProperty("position", "fixed");
document.body.offsetTop;
s.setProperty("overflow", "hidden");
s.setProperty("height", "0");
s.setProperty("width", "0");
document.body.offsetTop;
s.setProperty("display", "none");
}
</script>
</head>
<body onload="test()">
<p>
Test for <i><a href="rdar://problem/7094146">rdar://problem/7094146</a>
Reproducible crash at RenderObject::localToAbsolute()</i>.
</p>
<p>
This crash occurred after an object&rsquo;s position changed directly
from absolute to fixed, and it was not added to the RenderView&rsquo;s
positioned objects list nor removed from its old container&rsquo;s list.
</p>
<div style="position: relative;">
<div id="target" style="top: 50px; position: absolute;">
<div style="height: 50px; width: 50px; background-color: red;"></div>
</div>
</div>
</body>