LayoutTests/fast/dynamic/position-absolute-to-fixed-crash.html - WebKit - Git at Google

 <head>
     <script>
         if (testRunner)
             testRunner.dumpAsText();

         function test()
         {
             document.body.offsetTop;
             var s = document.getElementById("target").style;
             s.setProperty("position", "fixed");
             document.body.offsetTop;
             s.setProperty("overflow", "hidden");
             s.setProperty("height", "0");
             s.setProperty("width", "0");
             document.body.offsetTop;
             s.setProperty("display", "none");
         }
     </script>
 </head>
 <body onload="test()">
     <p>
         Test for <i><a href="rdar://problem/7094146">rdar://problem/7094146</a>
         Reproducible crash at RenderObject::localToAbsolute()</i>.
     </p>
     <p>
         This crash occurred after an object&rsquo;s position changed directly
         from absolute to fixed, and it was not added to the RenderView&rsquo;s
         positioned objects list nor removed from its old container&rsquo;s list.
     </p>
     <div style="position: relative;">
         <div id="target" style="top: 50px; position: absolute;">
             <div style="height: 50px; width: 50px; background-color: red;"></div>
         </div>
     </div>
 </body>
	<head>
	<script>
	if (testRunner)
	testRunner.dumpAsText();

	function test()
	{
	document.body.offsetTop;
	var s = document.getElementById("target").style;
	s.setProperty("position", "fixed");
	document.body.offsetTop;
	s.setProperty("overflow", "hidden");
	s.setProperty("height", "0");
	s.setProperty("width", "0");
	document.body.offsetTop;
	s.setProperty("display", "none");
	}
	</script>
	</head>
	<body onload="test()">
	<p>
	Test for <i><a href="rdar://problem/7094146">rdar://problem/7094146</a>
	Reproducible crash at RenderObject::localToAbsolute()</i>.
	</p>
	<p>
	This crash occurred after an object’s position changed directly
	from absolute to fixed, and it was not added to the RenderView’s
	positioned objects list nor removed from its old container’s list.
	</p>
	<div style="position: relative;">
	<div id="target" style="top: 50px; position: absolute;">
	<div style="height: 50px; width: 50px; background-color: red;"></div>
	</div>
	</div>
	</body>