<!DOCTYPE html>
<!-- Disable auto scrollbars, to avoid an extra layout pass, which
would hide the bug. The original fuzzer test instead used an
insane margin on an atomic inline to make sure the scrollbars
stayed put. -->
<style>body { overflow:scroll; }</style>
<p>PASS if no crash.</p>
<div id="rightFloat" style="float:right; height:40px;"></div>
<div style="float:left; height:300px;"></div>
<span>
<div id="inlineBlock2" style="display:none; width:30px; height:300px;"></div>
<span id="inline" style="display:none;">x</span>
</span>
<div>
<div style="height:40px;"></div>
<div style="display:table; writing-mode:vertical-lr;">
<div>
<div id="dummyBlock" style="display:none;"></div>
</div>
<div id="inlineBlock1" style="display:inline-block; width:30px; height:300px;"></div>
</div>
</div>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script>
if (window.testRunner)
testRunner.dumpAsText();
test(() => {
document.body.offsetTop;
document.getElementById("inlineBlock1").style.display = "none";
document.getElementById("inlineBlock2").style.display = "inline-block";
document.body.offsetTop;
document.getElementById("rightFloat").style.display = "none";
document.getElementById("dummyBlock").style.display = "block";
document.body.offsetTop;
document.getElementById("inline").style.display = "inline";
}, "no crash or assertion failure");
</script>