| <!DOCTYPE html> |
| |
| <!-- Disable auto scrollbars, to avoid an extra layout pass, which |
| would hide the bug. The original fuzzer test instead used an |
| insane margin on an atomic inline to make sure the scrollbars |
| stayed put. --> |
| <style>body { overflow:scroll; }</style> |
| |
| <p>PASS if no crash.</p> |
| |
| <div id="rightFloat" style="float:right; height:40px;"></div> |
| <div style="float:left; height:300px;"></div> |
| <span> |
| <div id="inlineBlock2" style="display:none; width:30px; height:300px;"></div> |
| <span id="inline" style="display:none;">x</span> |
| </span> |
| <div> |
| <div style="height:40px;"></div> |
| <div style="display:table; writing-mode:vertical-lr;"> |
| <div> |
| <div id="dummyBlock" style="display:none;"></div> |
| </div> |
| <div id="inlineBlock1" style="display:inline-block; width:30px; height:300px;"></div> |
| </div> |
| </div> |
| <script src="../../resources/testharness.js"></script> |
| <script src="../../resources/testharnessreport.js"></script> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| test(() => { |
| document.body.offsetTop; |
| document.getElementById("inlineBlock1").style.display = "none"; |
| document.getElementById("inlineBlock2").style.display = "inline-block"; |
| document.body.offsetTop; |
| document.getElementById("rightFloat").style.display = "none"; |
| document.getElementById("dummyBlock").style.display = "block"; |
| document.body.offsetTop; |
| document.getElementById("inline").style.display = "inline"; |
| }, "no crash or assertion failure"); |
| </script> |
