<!DOCTYPE html>
<html>
Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer<br />
Test passes if it does not crash.<br />
<div id="container">
  <q>
    <q id="test1"></q>
  </q>
  <q id="test2">
    <q style="float: left"></q>
    <q id="test3">
      <q style="position: fixed;">
    </q>
  </q>
</div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

document.body.offsetTop;
test3.style.display = "table-footer-group";
test3.focus();
test1.style.display = "table-row-group";
test2.style.display = "inline-block";
</script>
</html>