LayoutTests/fast/layers/removed-by-scroll-handler.html

<script>
    if (window.layoutTestController) {
        layoutTestController.waitUntilDone();
        layoutTestController.dumpAsText();
    }
</script>
<p>
    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=8360">http://bugs.webkit.org/show_bug.cgi?id=8360</a>
    Repro crash when onscroll handler deletes the scrolled object</i>.
</p>
<p>
    Result: <span id="result">test did not complete.</span>
</p>
<div id="t" style="overflow: auto; width: 200px; height: 100px;" onscroll="if (overflowRemove) this.parentNode.removeChild(this);">
    <div style="height: 200px;"></div>
</div>

<div style="overflow: auto; width: 200px; height: 100px;" onscroll="if (secondOverflowRemove) this.parentNode.removeChild(this);">
    <div style="height: 200px;"></div>
    <div id="d"></div>
</div>

<script>
    var overflowRemove = false;
    var secondOverflowRemove = false;

    document.body.offsetTop; t.scrollTop = 20;

    overflowRemove = true;
    document.getElementById('t').innerHTML = '';

    secondOverflowRemove = true;
    document.getElementById('d').scrollIntoView();
    
    document.getElementById('result').innerText = "SUCCESS";

    if (window.layoutTestController)
        layoutTestController.notifyDone();
</script>