36 lines
1.2 KiB
HTML
36 lines
1.2 KiB
HTML
<head>
|
|
<script>
|
|
if (testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
function test()
|
|
{
|
|
document.body.offsetTop;
|
|
var s = document.getElementById("target").style;
|
|
s.setProperty("position", "fixed");
|
|
document.body.offsetTop;
|
|
s.setProperty("overflow", "hidden");
|
|
s.setProperty("height", "0");
|
|
s.setProperty("width", "0");
|
|
document.body.offsetTop;
|
|
s.setProperty("display", "none");
|
|
}
|
|
</script>
|
|
</head>
|
|
<body onload="test()">
|
|
<p>
|
|
Test for <i><a href="rdar://problem/7094146">rdar://problem/7094146</a>
|
|
Reproducible crash at RenderObject::localToAbsolute()</i>.
|
|
</p>
|
|
<p>
|
|
This crash occurred after an object’s position changed directly
|
|
from absolute to fixed, and it was not added to the RenderView’s
|
|
positioned objects list nor removed from its old container’s list.
|
|
</p>
|
|
<div style="position: relative;">
|
|
<div id="target" style="top: 50px; position: absolute;">
|
|
<div style="height: 50px; width: 50px; background-color: red;"></div>
|
|
</div>
|
|
</div>
|
|
</body>
|