Bug 301363 – Assertion failure in RenderLayer::recursiveUpdateLayerPositions after evaluation-time zoom support

• Component: CSS
• Status: NEW

[Taher]

This issue surfaced after marking InsetEdge properties (top/left/right/bottom) with the CSS::AllUnzoomed bit for evaluation-time zoom support.

No idea what's happening during verification and read stage. Possibly some non-determinism? Will need to investigate this further

When the following conditions combine:
  1. Non-unit CSS zoom (e.g., zoom: 0.3)
  2. Column layout (column-count: 1)
  3. 3D transforms at specific angles (rotate3d(0, 1, 0, 90deg) or 270deg)

```
<style>
  .fixed {
    position: fixed;
    zoom: 0.3;
    column-count: 1;
  }

  .transformed {
    transform: rotate3d(0, 1, 0, 90deg);  /* or 270deg */
  }

  .fixed-only {
    position: fixed;
  }
  </style>
  <div class="fixed">
    <div class="transformed">
      <div class="fixed-only"></div>
    </div>
  </div>
```

[Radar WebKit Bug Importer]

<rdar://problem/163276620>