In mapAncestorToLocal, account for frame documents always being fixed-position containers.

third_party/WebKit/Source/core/layout/LayoutView.cpp

Index: third_party/WebKit/Source/core/layout/LayoutView.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutView.cpp b/third_party/WebKit/Source/core/layout/LayoutView.cpp
index 5da123b695f693d7e53dedbd6546c97f8156820b..632261ac2556e30c2672fc7851418f87d4541e4f 100644
--- a/third_party/WebKit/Source/core/layout/LayoutView.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutView.cpp
@@ -405,6 +405,9 @@ void LayoutView::mapAncestorToLocal(const LayoutBoxModelObject* ancestor, Transf
 
     if (mode & TraverseDocumentBoundaries) {
         if (LayoutPart* parentDocLayoutObject = frame()->ownerLayoutObject()) {
+            // A LayoutView is a containing block for fixed-position elements, so don't carry this state across frames.
+            mode &= !IsFixed;

[szager1, 2016/03/04 07:41:05]

Shouldn't this be:

mode &= ~IsFixed;

?

+
             parentDocLayoutObject->mapAncestorToLocal(ancestor, transformState, mode);
             transformState.move(parentDocLayoutObject->contentBoxOffset());
             transformState.move(-frame()->view()->scrollOffset());