Disallow 'position: sticky' on <thead> and <tr> elements.

third_party/WebKit/Source/core/css/resolver/StyleAdjuster.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc.
  * All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
@@ skipping 321 matching lines @@
   if (style.display() == EDisplay::Contents)
     return;
 
   // FIXME: Don't support this mutation for pseudo styles like first-letter or
   // first-line, since it's not completely clear how that should work.
   if (style.display() == EDisplay::Inline &&
       style.styleType() == PseudoIdNone &&
       style.getWritingMode() != layoutParentStyle.getWritingMode())
     style.setDisplay(EDisplay::InlineBlock);
 
-  // After performing the display mutation, check table rows. We do not honor
-  // position: relative table rows. This has been established for position:
-  // relative in CSS2.1 (and caused a crash in containingBlock() on some sites).
+  // We do not honor position: relative or sticky for table rows, headers, and
+  // footers. This is correct for position: relative in CSS2.1 (and caused a
+  // crash in containingBlock() on some sites) and position: sticky is defined
+  // as following position: relative behavior for table elements. It is
+  // incorrect for CSS3.
   if ((style.display() == EDisplay::TableHeaderGroup ||
        style.display() == EDisplay::TableRowGroup ||
        style.display() == EDisplay::TableFooterGroup ||
        style.display() == EDisplay::TableRow) &&
-      style.position() == EPosition::kRelative)
+      style.hasInFlowPosition())
     style.setPosition(EPosition::kStatic);
 
   // Cannot support position: sticky for table columns and column groups because
   // current code is only doing background painting through columns / column
   // groups.
   if ((style.display() == EDisplay::TableColumnGroup ||
        style.display() == EDisplay::TableColumn) &&
       style.position() == EPosition::kSticky)
     style.setPosition(EPosition::kStatic);
 
@@ skipping 143 matching lines @@
       style.setDisplay(EDisplay::Block);
 
     // Columns don't apply to svg text elements.
     if (isSVGTextElement(*element))
       style.clearMultiCol();
   }
   adjustStyleForAlignment(style, parentStyle);
 }
 
 }  // namespace blink