<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
Test passes if it does not crash.
<head id="head1" style="-webkit-writing-mode: horizontal-bt;"></head>
<i id="i1"><button id="button1"></button></i>
<td id="td1"><body id="body2"></body></td>
<i id="i2"></i>
<style>
.class1 { float: left; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var docElement = document.documentElement;

function crash() {
    head1 = document.getElementById("head1");
    i1 = document.getElementById("i1");
    td1 = document.getElementById("td1");
    i2 = document.getElementById("i2");
    body2 = document.getElementById("body2");
    button1 = document.getElementById("button1");

    // Makes it float and then intrude into anonymous block parent of i2.
    button1.classList.toggle("class1");

    // Moving td1, moves its body child. Body child inherits writing mode(bt) from head.
    // And updating body's writing mode updates docElement's writing mode.
    head1.appendChild(td1);

    docElement.offsetTop;

    head1.style.display = "list-item";

    docElement.offsetTop;

    button1.classList.toggle("class1");
}
document.addEventListener("DOMContentLoaded", crash, false);
</script>
</html>