third_party/WebKit/LayoutTests/fast/dynamic/position-absolute-to-fixed-crash.html

   1 <head>
   2     <script>
   3         if (testRunner)
   4             testRunner.dumpAsText();
   5
   6         function test()
   7         {
   8             document.body.offsetTop;
   9             var s = document.getElementById("target").style;
  10             s.setProperty("position", "fixed");
  11             document.body.offsetTop;
  12             s.setProperty("overflow", "hidden");
  13             s.setProperty("height", "0");
  14             s.setProperty("width", "0");
  15             document.body.offsetTop;
  16             s.setProperty("display", "none");
  17         }
  18     </script>
  19 </head>
  20 <body onload="test()">
  21     <p>
  22         Test for <i><a href="rdar://problem/7094146">rdar://problem/7094146</a>
  23         Reproducible crash at LayoutObject::localToAbsolute()</i>.
  24     </p>
  25     <p>
  26         This crash occurred after an object&rsquo;s position changed directly
  27         from absolute to fixed, and it was not added to the LayoutView&rsquo;s
  28         positioned objects list nor removed from its old container&rsquo;s list.
  29     </p>
  30     <div style="position: relative;">
  31         <div id="target" style="top: 50px; position: absolute;">
  32             <div style="height: 50px; width: 50px; background-color: red;"></div>
  33         </div>
  34     </div>
  35 </body>