Bug 97123

Summary: Incorrect nested layer composition when enabling accelerated fixed-position compositing
Product: WebKit Reporter: Haixia Shi <hshi>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: bdakin, jamesr, simon.fraser, timehat
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Linux   
Attachments:
Description Flags
Simple reproduction none

Haixia Shi
Reported 2012-09-19 11:25:43 PDT
(Originally filed as http://crbug.com/150724) Chrome 23.0.1271.0 WebKit 537.11 (trunk@128901) Command-line flags: - setAcceleratedCompositingEnabled(true) - setAcceleratedCompositingForFixedPositionEnabled(true) HTML page content: <html><body> <div style="position:fixed;top:100px;left:100px;"> <div style="position:fixed;top:100px;left:100px;"> <input type="text" data-type="number" size="4"> </div> </div> </body></html> Procedure to reproduce bug: (1) enter some text in the <input> element so that the text width exceeds the width of the <input>; (2) press <backspace> key. (or alternatively: select a multi-character substring of the text entered, and enter any key to substitute the substring with a single character) -- this step is to cause a reduction of text width. Problem observed: suddenly the <input> element is drawn to the wrong place.
Attachments
Simple reproduction (446 bytes, text/html)
2012-09-26 16:31 PDT, Tim Ehat 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Haixia Shi
Comment 1 2012-09-25 15:47:48 PDT
The same problem can be reproduced with Chrome browser on Linux, when the command-line arguments "--enable-acelerated-compositing --enable-fixed-position-compositing" are present.
Tim Ehat
Comment 2 2012-09-26 16:31:03 PDT
Created attachment 165895 [details] Simple reproduction
Tim Ehat
Comment 3 2012-09-26 16:34:09 PDT
Attached is a simple reproduction (I suppose just an extra way separate from the one already listed here. One difference is how it's triggered. In this case, an element that is composited is underneath an element with fixed positioning. Inside that fixed element is yet another element with absolute positioning. The input field is within that absolutely positioned element. Seen this on Chrome 22 that was released today as well as in the canary version. Also reproduces in Safari on an iPad.
Haixia Shi
Comment 4 2012-12-06 13:59:13 PST
This is no longer happening on the Chrome R25 dev builds. I bisected the recent revisions and confirmed that http://trac.webkit.org/changeset/133628 fixed the problem.
Note You need to log in before you can comment on or make changes to this bug.