HTML Element changing from position: fixed to position: sticky crashes webkit process

Originator:oliver.byford
Number:rdar://29460159 Date Originated:1 Dec 2016
Status:Duplicate/28465188 Resolved:
Product:Safari Product Version:10.0
Classification: Reproducible:Always
 
Summary:
When an HTML element that was previously of type `position: fixed;` is changed to type `position: sticky;` it crashes the Webkit process.

Steps to Reproduce:
1. Load the 'open' example (open.html) in an iOS browser.
2. Click the 'Show / Hide Table of Contents' toggle link

Expected Results:
The nav reverts to stick at the top of the screen, as in the initial state of the 'closed' example.


Actual Results:
The web content process crashes and the page is reloaded.

Version:
Safari Version 10.0 (12602.1.50.0.10)
macOS 10.12 (16A323)


Notes:
This also happens on iOS (#29459895) although less consistently – sometimes it doesn't crash on iOS but still renders strangely.

Configuration:
See dump file

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!