Bug 36686

Summary: Handling of fixed pos state in mapLocalToContainer() may be wrong
Product: WebKit Reporter: Simon Fraser (smfr) <simon.fraser>
Component: Layout and RenderingAssignee: Simon Fraser (smfr) <simon.fraser>
Status: NEW ---    
Severity: Normal CC: benjamin, hausmann, kenneth
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Bug Depends on: 37637    
Bug Blocks: 36652    
Attachments:
Description Flags
Test case
none
Quick patch
none
New test case without transormation none

Description Simon Fraser (smfr) 2010-03-26 18:11:32 PDT
mapLocalToContainer() may do the wrong thing when called directly on a fixed, transformed element, because 'fixed' on entry is false, and will stay false when we hit the hasTransform test.
Comment 1 Simon Fraser (smfr) 2010-03-26 18:15:15 PDT
See bug 36652 also.
Comment 2 Benjamin Poulain 2010-03-29 05:36:26 PDT
I agree, this looks wrong.
I will do a pixel test for it.
Comment 3 Benjamin Poulain 2010-03-29 08:39:50 PDT
Created attachment 51916 [details]
Test case

Another test case, this one should have the problems of computeRectForRepaint() and mapLocalToContainer().
Comment 4 Benjamin Poulain 2010-03-29 09:17:26 PDT
Created attachment 51919 [details]
Quick patch

Quick fix.
It passes the test and solve https://bug-36652-attachments.webkit.org/attachment.cgi?id=51750
But curiously, not https://bug-36686-attachments.webkit.org/attachment.cgi?id=51916 although the update rect is now at the correct position. I need to investigate why the previous area is not repainted correctly.
Comment 5 Benjamin Poulain 2010-03-29 12:48:41 PDT
Created attachment 51951 [details]
New test case without transormation

Apparently, the previous test case also show another, possibly unrelated, bug.

This attachment is similar to https://bugs.webkit.org/attachment.cgi?id=51916 without the transformation. The bug is still present.

I think about submitting this patch: https://bugs.webkit.org/attachment.cgi?id=51919 with this test: https://bug-36652-attachments.webkit.org/attachment.cgi?id=51750 for this bug report. And create a new bug report for https://bugs.webkit.org/attachment.cgi?id=51916 which look a bit more urgent than the current task. Simon, is that ok with you?
Comment 6 Simon Fraser (smfr) 2010-03-29 13:46:08 PDT
I think we should fix the non-transformed bug (your last testcase) first.
Comment 7 Benjamin Poulain 2010-03-29 14:39:55 PDT
(In reply to comment #6)
> I think we should fix the non-transformed bug (your last testcase) first.

I agree. I have created the bug report https://bugs.webkit.org/show_bug.cgi?id=36783 for this case.

I might be able to investigate it tomorrow. I will also make a proper patch for 36686 so I have a chance to close 36652 this week.
Comment 8 Kenneth Rohde Christiansen 2010-05-07 07:11:11 PDT
(In reply to comment #7)
> (In reply to comment #6)
> > I think we should fix the non-transformed bug (your last testcase) first.
> 
> I agree. I have created the bug report
> https://bugs.webkit.org/show_bug.cgi?id=36783 for this case.
> 
> I might be able to investigate it tomorrow. I will also make a proper patch for
> 36686 so I have a chance to close 36652 this week.

Any work on this?