Fix order of operations in LayoutView::mapAncestorToLocal

third_party/WebKit/Source/core/layout/LayoutView.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 357 matching lines @@
     }
 
     return container;
 }
 
 void LayoutView::mapAncestorToLocal(const LayoutBoxModelObject* ancestor, TransformState& transformState, MapCoordinatesFlags mode) const
 {
     if (this == ancestor)
         return;
 
-    if (mode & IsFixed && m_frameView)
-        transformState.move(m_frameView->scrollOffset());
-
-    if (mode & UseTransforms && shouldUseTransformFromContainer(0)) {
-        TransformationMatrix t;
-        getTransformFromContainer(0, LayoutSize(), t);
-        transformState.applyTransform(t);
-    }
-
     if (mode & TraverseDocumentBoundaries) {
         if (LayoutPart* parentDocLayoutObject = frame()->ownerLayoutObject()) {
             // A LayoutView is a containing block for fixed-position elements, so don't carry this state across frames.
-            mode &= ~IsFixed;
+            parentDocLayoutObject->mapAncestorToLocal(ancestor, transformState, mode & ~IsFixed);
 
+            transformState.move(parentDocLayoutObject->contentBoxOffset());
             transformState.move(-frame()->view()->scrollOffset());
-            transformState.move(parentDocLayoutObject->contentBoxOffset());
-
-            parentDocLayoutObject->mapAncestorToLocal(ancestor, transformState, mode);
         }
     } else {
         ASSERT(!ancestor);
     }
+
+    if (mode & IsFixed)
+        transformState.move(frame()->view()->scrollOffset());
 }
 
 void LayoutView::computeSelfHitTestRects(Vector<LayoutRect>& rects, const LayoutPoint&) const
 {
     // Record the entire size of the contents of the frame. Note that we don't just
     // use the viewport size (containing block) here because we want to ensure this includes
     // all children (so we can avoid walking them explicitly).
     rects.append(LayoutRect(LayoutPoint::zero(), LayoutSize(frameView()->contentsSize())));
 }
 
@@ skipping 590 matching lines @@
     // of this override. All frame scrolling should be handled by
     // ViewportScrollCallback.
 
     if (!frameView())
         return ScrollResult(false, false, delta.width(), delta.height());
 
     return frameView()->getScrollableArea()->userScroll(granularity, delta);
 }
 
 } // namespace blink