| <head> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| function test() |
| { |
| document.body.offsetTop; |
| var s = document.getElementById("target").style; |
| s.setProperty("position", "fixed"); |
| document.body.offsetTop; |
| s.setProperty("overflow", "hidden"); |
| s.setProperty("height", "0"); |
| s.setProperty("width", "0"); |
| document.body.offsetTop; |
| s.setProperty("display", "none"); |
| } |
| </script> |
| </head> |
| <body onload="test()"> |
| <p> |
| Test for <i><a href="rdar://problem/7094146">rdar://problem/7094146</a> |
| Reproducible crash at LayoutObject::localToAbsolute()</i>. |
| </p> |
| <p> |
| This crash occurred after an object’s position changed directly |
| from absolute to fixed, and it was not added to the LayoutView’s |
| positioned objects list nor removed from its old container’s list. |
| </p> |
| <div style="position: relative;"> |
| <div id="target" style="top: 50px; position: absolute;"> |
| <div style="height: 50px; width: 50px; background-color: red;"></div> |
| </div> |
| </div> |
| </body> |
