<script> function test() { document.body.offsetTop; // force layout var t = document.getElementById('t'); t.style.position = 'relative'; document.body.offsetTop; // force layout t.lastChild.removeChild(t.lastChild.lastChild); } </script> <body onload="test()"> <p> This is a regression test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=11672">http://bugs.webkit.org/show_bug.cgi?id=11672</a> REGRESSION (r17068): Repro crash due to painting without layout</i>. It should not crash. </p> <table id = "t"> <tr> <td> <div style="position: absolute;">Lorem ipsum</div> </td> </tr> <tr> <td></td></tr></table> </body>