third_party/WebKit/LayoutTests/fast/dynamic/position-absolute-to-fixed-crash.html


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

<head>
    <script>
        if (testRunner)
            testRunner.dumpAsText();

        function test()
        {
            document.body.offsetTop;
            var s = document.getElementById("target").style;
            s.setProperty("position", "fixed");
            document.body.offsetTop;
            s.setProperty("overflow", "hidden");
            s.setProperty("height", "0");
            s.setProperty("width", "0");
            document.body.offsetTop;
            s.setProperty("display", "none");
        }
    </script>
</head>
<body onload="test()">
    <p>
        Test for <i><a href="rdar://problem/7094146">rdar://problem/7094146</a>
        Reproducible crash at LayoutObject::localToAbsolute()</i>.
    </p>
    <p>
        This crash occurred after an object&rsquo;s position changed directly
        from absolute to fixed, and it was not added to the LayoutView&rsquo;s
        positioned objects list nor removed from its old container&rsquo;s list. 
    </p>
    <div style="position: relative;">
        <div id="target" style="top: 50px; position: absolute;">
            <div style="height: 50px; width: 50px; background-color: red;"></div>
        </div>
    </div>
</body>