Don't squash fixed-position elements into another fixed-position element that has a clip.

Source/core/rendering/compositing/CompositingInputsUpdater.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/rendering/compositing/CompositingInputsUpdater.h"
 
 #include "core/rendering/RenderBlock.h"
 #include "core/rendering/RenderLayer.h"
 #include "core/rendering/compositing/CompositedLayerMapping.h"
@@ skipping 17 matching lines @@
     TRACE_EVENT0("blink", "CompositingInputsUpdater::update");
     updateRecursive(m_rootRenderLayer, DoNotForceUpdate, AncestorInfo());
 }
 
 static const RenderLayer* findParentLayerOnClippingContainerChain(const RenderLayer* layer)
 {
     RenderObject* current = layer->renderer();
     while (current) {
         if (current->style()->position() == FixedPosition) {
             for (current = current->parent(); current && !current->canContainFixedPositionObjects(); current = current->parent()) {
+                // All types of clips apply to fixed-position descendants of other fixed-position elements.
+                // Note: it's unclear whether this is what the spec says. Firefox does not clip, but Chrome does.
+                if (current->style()->position() == FixedPosition && current->hasClipOrOverflowClip()) {
+                    ASSERT(current->hasLayer());
+                    return static_cast<const RenderLayerModelObject*>(current)->layer();
+                }
+
                 // CSS clip applies to fixed position elements even for ancestors that are not what the
                 // fixed element is positioned with respect to.
                 if (current->hasClip()) {
                     ASSERT(current->hasLayer());
                     return static_cast<const RenderLayerModelObject*>(current)->layer();
                 }
             }
         } else {
             current = current->containingBlock();
         }
@@ skipping 135 matching lines @@
     ASSERT(!layer->childNeedsCompositingInputsUpdate());
     ASSERT(!layer->needsCompositingInputsUpdate());
 
     for (RenderLayer* child = layer->firstChild(); child; child = child->nextSibling())
         assertNeedsCompositingInputsUpdateBitsCleared(child);
 }
 
 #endif
 
 } // namespace blink