In mapAncestorToLocal, account for frame documents always being fixed-position containers.

third_party/WebKit/Source/core/layout/LayoutView.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 387 matching lines @@
         transformState.move(toIntSize(m_frameView->scrollPosition()));
 
     if (mode & UseTransforms && shouldUseTransformFromContainer(0)) {
         TransformationMatrix t;
         getTransformFromContainer(0, LayoutSize(), t);
         transformState.applyTransform(t);
     }
 
     if (mode & TraverseDocumentBoundaries) {
         if (LayoutPart* parentDocLayoutObject = frame()->ownerLayoutObject()) {
+            // A LayoutView is a containing block for fixed-position elements, so don't carry this state across frames.
+            mode &= !IsFixed;

[szager1, 2016/03/04 07:41:05]

Shouldn't this be:

mode &= ~IsFixed;

?

+
             parentDocLayoutObject->mapAncestorToLocal(ancestor, transformState, mode);
             transformState.move(parentDocLayoutObject->contentBoxOffset());
             transformState.move(-frame()->view()->scrollOffset());
         }
     } else {
         ASSERT(!ancestor);
     }
 }
 
 void LayoutView::computeSelfHitTestRects(Vector<LayoutRect>& rects, const LayoutPoint&) const
@@ skipping 598 matching lines @@
     if (!document().ownerElement())
         setHasBoxDecorationBackground(true);
 }
 
 bool LayoutView::allowsOverflowClip() const
 {
     return document().settings() && document().settings()->rootLayerScrolls();
 }
 
 } // namespace blink