position-absolute-to-fixed-crash.html

<head>
    <script>
        if (window.testRunner)
            testRunner.dumpAsText();

        function test()
        {
            document.body.offsetTop;
            var s = document.getElementById("target").style;
            s.setProperty("position", "fixed");
            document.body.offsetTop;
            s.setProperty("overflow", "hidden");
            s.setProperty("height", "0");
            s.setProperty("width", "0");
            document.body.offsetTop;
            s.setProperty("display", "none");
        }
    </script>
</head>
<body onload="test()">
    <p>
        Test for <i><a href="rdar://problem/7094146">rdar://problem/7094146</a>
        Reproducible crash at LayoutObject::localToAbsolute()</i>.
    </p>
    <p>
        This crash occurred after an object&rsquo;s position changed directly
        from absolute to fixed, and it was not added to the LayoutView&rsquo;s
        positioned objects list nor removed from its old container&rsquo;s list. 
    </p>
    <div style="position: relative;">
        <div id="target" style="top: 50px; position: absolute;">
            <div style="height: 50px; width: 50px; background-color: red;"></div>
        </div>
    </div>
</body>
chromium/third_party/blink/web_tests/fast/dynamic/position-absolute-to-fixed-crash.html
