Fixed-position repaint invalidations should be sent to the correct composited layer.

Source/core/page/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 1345 matching lines @@
             || layer->viewportConstrainedNotCompositedReason() == RenderLayer::NotCompositedForNoVisibleContent) {
             // Don't invalidate for invisible fixed layers.
             continue;
         }
 
         if (layer->hasAncestorWithFilterOutsets()) {
             // If the fixed layer has a blur/drop-shadow filter applied on at least one of its parents, we cannot
             // scroll using the fast path, otherwise the outsets of the filter will be moved around the page.
             return false;
         }
+
         IntRect updateRect = pixelSnappedIntRect(layer->repaintRectIncludingNonCompositingDescendants());
-        updateRect = contentsToRootView(updateRect);
-        if (!isCompositedContentLayer && clipsRepaints())
-            updateRect.intersect(rectToScroll);
-        if (!updateRect.isEmpty())
-            regionToUpdate.unite(updateRect);
+
+        RenderLayer* enclosingCompositingLayer = layer->enclosingCompositingLayer(false);
+        if (enclosingCompositingLayer && !enclosingCompositingLayer->renderer()->isRenderView()) {
+            // If the fixed-position layer is contained by a composited layer that is not its containing block,
+            // then we have to invlidate that enclosing layer, not the RenderView.

[enne (OOO), 2013/09/11 21:09:39]

typo: invalidate

+            updateRect.moveBy(scrollPosition());

[enne (OOO), 2013/09/11 21:09:39]

Can you convince me that the scrollPosition is the only thing you need to look
at to get into the space of the parent enclosing composited layer?

[shawnsingh, 2013/09/11 23:10:38]

The function that computes the update rect 8 lines above this -->
repaintRectIncludingNonCompositingDescendants() is by definition intended to
return the rect in the space of its repaint container.
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

Double-checking the implementation of containerForRepaint(), if compositing is
enabled it is exactly equivalent to enclosingCompositingLayer().
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

[enne (OOO), 2013/09/12 00:07:53]

Hrm. In that case, why do you need to add scrollPosition() in as well? If this
updateRect was in the space of the repaint container, then I would expect that
it would only need to move by scrollDelta.

+            IntRect previousRect = updateRect;
+            previousRect.move(scrollDelta);
+            updateRect.unite(previousRect);
+            enclosingCompositingLayer->setBackingNeedsRepaintInRect(updateRect);
+        } else {
+            // Coalesce the repaints that will be issued to the renderView.
+            updateRect = contentsToRootView(updateRect);
+            if (!isCompositedContentLayer && clipsRepaints())
+                updateRect.intersect(rectToScroll);
+            if (!updateRect.isEmpty())
+                regionToUpdate.unite(updateRect);
+        }
     }
 
     // 1) scroll
     hostWindow()->scroll(scrollDelta, rectToScroll, clipRect);
 
     // 2) update the area of fixed objects that has been invalidated
     Vector<IntRect> subRectsToUpdate = regionToUpdate.rects();
     size_t viewportConstrainedObjectsCount = subRectsToUpdate.size();
     for (size_t i = 0; i < viewportConstrainedObjectsCount; ++i) {
         IntRect updateRect = subRectsToUpdate[i];
@@ skipping 1998 matching lines @@
         return frame().document()->existingAXObjectCache();
     return 0;
 }
 
 bool FrameView::isMainFrame() const
 {
     return m_frame->page() && m_frame->page()->mainFrame() == m_frame;
 }
 
 } // namespace WebCore