LayoutTests/fast/layers/removed-by-scroll-handler.html

<script>
    if (window.testRunner) {
        testRunner.waitUntilDone();
        testRunner.dumpAsText();
    }
</script>
<p>
    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=8360">http://bugs.webkit.org/show_bug.cgi?id=8360</a>
    Repro crash when onscroll handler deletes the scrolled object</i>.
</p>
<p>
    Result: <span id="result">test did not complete.</span>
</p>
<div id="t" style="overflow: auto; width: 200px; height: 100px;" onscroll="this.parentNode.removeChild(this);handleScroll(0);">
    <div style="height: 200px;"></div>
</div>

<div style="overflow: auto; width: 200px; height: 100px;" onscroll="this.parentNode.removeChild(this);handleScroll(1);">
    <div style="height: 200px;"></div>
    <div id="d"></div>
</div>

<script>
    var scrolledFirstContainer = false;
    var scrolledSecondContainer = false;

    document.body.offsetTop; t.scrollTop = 20;

    document.getElementById('d').scrollIntoView();
    
    function handleScroll(index)
    {
        if (index == 0) scrolledFirstContainer = true;
        else if (index == 1) scrolledSecondContainer = true;
        
        if (scrolledFirstContainer && scrolledSecondContainer) {
            document.getElementById('result').innerText = "SUCCESS";
        
            if (window.testRunner)
                testRunner.notifyDone();
        }
    }
</script>