Created attachment 136907 [details] File that's crashing WebKit Attempting to flow an element that has the CSS position set to "fixed" crashes WebKit. This only happens when actually trying to flow the content (creating a region that consumes the named flow), not when extracting the element into a named flow.
Created attachment 136908 [details] Crash dump on Windows 7 Enterprise x64, SP1 Reproduced on Nightly r112531
Created attachment 136910 [details] Crash log on Mac OS X Lion with WebKit nightly r113941
Duplicate of https://bugs.webkit.org/show_bug.cgi?id=88133.
*** This bug has been marked as a duplicate of bug 88133 ***