Fix accumulating offsets for fixed positioned layers

Source/core/paint/DeprecatedPaintLayer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 1361 matching lines @@
         location += LayoutSize(absPos.x(), absPos.y());
         return ancestorLayer;
     }
 
     // For the fixed positioned elements inside a layout flow thread, we should also skip the code path below
     // Otherwise, for the case of ancestorLayer == rootLayer and fixed positioned element child of a transformed
     // element in layout flow thread, we will hit the fixed positioned container before hitting the ancestor layer.
     if (position == FixedPosition) {
         // For a fixed layers, we need to walk up to the root to see if there's a fixed position container
         // (e.g. a transformed layer). It's an error to call convertToLayerCoords() across a layer with a transform,
-        // so we should always find the ancestor at or before we find the fixed position container.
+        // so we should always find the ancestor at or before we find the fixed position container, if
+        // the container is transformed.
         DeprecatedPaintLayer* fixedPositionContainerLayer = 0;
         bool foundAncestor = false;
         for (DeprecatedPaintLayer* currLayer = layer->parent(); currLayer; currLayer = currLayer->parent()) {
             if (currLayer == ancestorLayer)
                 foundAncestor = true;
 
             if (isFixedPositionedContainer(currLayer)) {
                 fixedPositionContainerLayer = currLayer;
-                ASSERT_UNUSED(foundAncestor, foundAncestor);
+                // A layer that has a transform-related property but not a
+                // transform still acts as a fixed-position container.
+                // Accumulating offsets across such layers is allowed.
+                if (currLayer->transform())
+                    ASSERT_UNUSED(foundAncestor, foundAncestor);
                 break;
             }
         }
 
         ASSERT(fixedPositionContainerLayer); // We should have hit the LayoutView's layer at least.
 
         if (fixedPositionContainerLayer != ancestorLayer) {
             LayoutPoint fixedContainerCoords;
             layer->convertToLayerCoords(fixedPositionContainerLayer, fixedContainerCoords);
+            location += fixedContainerCoords;
 
-            LayoutPoint ancestorCoords;
-            ancestorLayer->convertToLayerCoords(fixedPositionContainerLayer, ancestorCoords);
-
-            location += (fixedContainerCoords - ancestorCoords);
+            if (foundAncestor) {

[chrishtr, 2015/04/30 17:46:01]

Why would it not find the ancestor? What does this have to do with the change
here?

[ajuma, 2015/04/30 17:57:15]

The code previously assumed that ancestorLayer was either the
fixedPositionContainerLayer or its descendant. We were hitting the assert (and
rendering incorrectly) when that wasn't the case. With the assert fixed, we
still need to compute the offset correctly for this case (where the
ancestorLayer is also an ancestor of the fixedPositionContainerLayer). We can't
call convertToLayerCoords below in that case, since that expects an ancestor of
ancestorLayer. So instead we only compute the offset up to the
fixedPositionContainerLayer, and allow the loop in the caller to then compute
the offset from the fixedPositionContainerLayer to the ancestorLayer.

+                LayoutPoint ancestorCoords;
+                ancestorLayer->convertToLayerCoords(fixedPositionContainerLayer, ancestorCoords);
+                location += -ancestorCoords;
+            }
         } else {
             // LayoutView has been handled in the first top-level 'if' block above.
             ASSERT(ancestorLayer != layoutObject->view()->layer());
             ASSERT(ancestorLayer->hasTransformRelatedProperty());
 
             location += layer->location();
         }
-        return ancestorLayer;
+        return foundAncestor ? ancestorLayer : fixedPositionContainerLayer;
     }
 
     DeprecatedPaintLayer* parentLayer;
     if (position == AbsolutePosition) {
         // Do what enclosingPositionedAncestor() does, but check for ancestorLayer along the way.
         parentLayer = layer->parent();
         bool foundAncestorFirst = false;
         while (parentLayer) {
             // LayoutFlowThread is a positioned container, child of LayoutView, positioned at (0,0).
             // This implies that, for out-of-flow positioned elements inside a LayoutFlowThread,
@@ skipping 1546 matching lines @@
     }
 }
 
 void showLayerTree(const blink::LayoutObject* layoutObject)
 {
     if (!layoutObject)
         return;
     showLayerTree(layoutObject->enclosingLayer());
 }
 #endif