Bug 98578

Summary: REGRESSION (r128787): Fixed position div unexpectedly moves to textarea
Product: WebKit Reporter: Kevin M. Dean <kevin>
Component: WebCore Misc.Assignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: bdakin, simon.fraser, thorton
Priority: P1 Keywords: InRadar, Regression
Version: 528+ (Nightly build)   
Hardware: Mac (Intel)   
OS: OS X 10.8   
URL: http://development.rhubarbproductions.com/webkit/paste/
Attachments:
Description Flags
Before
none
after
none
Table Row Before
none
Table Row After none

Kevin M. Dean
Reported 2012-10-05 18:14:53 PDT
This test link is reduced from a wordpress admin page where it places a admin bar with a position: fixed; on it. Load the test page. Select all the text, copy and then paste it below the existing text. Then select undo (Command-Z) and the dark bar at the top will jump to the 0,0 coordinate of the textarea when it should stay where it is. I believe there's other triggers since I've had this come up in other places in wordpress and another site editor.
Attachments
Before (23.67 KB, image/png)
2012-10-05 18:15 PDT, Kevin M. Dean
no flags
after (25.66 KB, image/png)
2012-10-05 18:16 PDT, Kevin M. Dean
no flags
Table Row Before (211.64 KB, image/png)
2013-01-17 13:54 PST, Kevin M. Dean
no flags
Table Row After (246.50 KB, image/png)
2013-01-17 13:55 PST, Kevin M. Dean
no flags
Kevin M. Dean
Comment 1 2012-10-05 18:15:46 PDT
Kevin M. Dean
Comment 2 2012-10-05 18:16:02 PDT
Kevin M. Dean
Comment 3 2012-10-05 18:18:37 PDT
Removing the position: fixed; from the top div with Web Inspector causes the glitch to not occur.
Kevin M. Dean
Comment 4 2012-10-05 18:23:33 PDT
Likely related to Bug 98579.
Kevin M. Dean
Comment 5 2012-10-06 08:35:06 PDT
After pasting, pressing the delete key until a line is completely removed will also trigger the glitch.
Alexey Proskuryakov
Comment 6 2012-10-08 11:55:17 PDT
In debug builds, an assertion fails: ASSERTION FAILED: enclosingIntRect(rendererMappedResult) == enclosingIntRect(FloatQuad(result).boundingBox()) /Users/ap/Safari/OpenSource/Source/WebCore/rendering/RenderGeometryMap.cpp(85) : WebCore::FloatRect WebCore::RenderGeometryMap::absoluteRect(const WebCore::FloatRect &) const 1 0x10aa81d19 WebCore::RenderGeometryMap::absoluteRect(WebCore::FloatRect const&) const 2 0x10aacea1e WebCore::RenderLayerCompositor::addToOverlapMap(WebCore::RenderLayerCompositor::OverlapMap&, WebCore::RenderLayer*, WebCore::IntRect&, bool&) 3 0x10aacc912 WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::RenderLayerCompositor::OverlapMap*, WebCore::CompositingState&, bool&, bool&) 4 0x10aacc7ef WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::RenderLayerCompositor::OverlapMap*, WebCore::CompositingState&, bool&, bool&) 5 0x10aacc7ef WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::RenderLayerCompositor::OverlapMap*, WebCore::CompositingState&, bool&, bool&) 6 0x10aacbd84 WebCore::RenderLayerCompositor::updateCompositingLayers(WebCore::CompositingUpdateType, WebCore::RenderLayer*) 7 0x10aa9fd6e WebCore::RenderLayer::updateCompositingLayersAfterScroll() 8 0x10aa9f8a3 WebCore::RenderLayer::scrollTo(int, int) 9 0x10aaa20ae WebCore::RenderLayer::setScrollOffset(WebCore::IntPoint const&) 10 0x10acdf84d WebCore::ScrollableArea::scrollPositionChanged(WebCore::IntPoint const&)
Alexey Proskuryakov
Comment 7 2012-10-08 12:00:24 PDT
Simon Fraser (smfr)
Comment 8 2012-11-05 18:58:09 PST
I am going to fix the assertion via bug 101292.
Beth Dakin
Comment 9 2013-01-17 12:44:38 PST
I can no longer reproduce this bug on TOT. Kevin, do you still see this?
Simon Fraser (smfr)
Comment 10 2013-01-17 12:54:14 PST
What if you disable the compositing-for-fixed stuff?
Kevin M. Dean
Comment 11 2013-01-17 13:54:13 PST
(In reply to comment #9) > I can no longer reproduce this bug on TOT. Kevin, do you still see this? I no longer see this specific case, but I do see a similar issue in another area of wordpress where a table row is removed via javascript and the page scrolls back to the top, but the fixed div jumps down the page until you click. I'll upload a before/after.
Kevin M. Dean
Comment 12 2013-01-17 13:54:42 PST
Created attachment 183269 [details] Table Row Before
Kevin M. Dean
Comment 13 2013-01-17 13:55:06 PST
Created attachment 183270 [details] Table Row After
Kevin M. Dean
Comment 14 2013-01-17 14:16:48 PST
I've set up a wordpress test area if you want to login and take a look. Just respond here or send me an email directly for the access information and instructions to trigger the bug.
Kevin M. Dean
Comment 15 2013-01-17 14:25:57 PST
This bug seems to happen in a different range, so I should probably open a new bug for it.
Kevin M. Dean
Comment 16 2013-01-17 14:43:16 PST
OK, if you're interested, head over to: Bug 107179 - REGRESSION (r139554-r139561): Fixed position div unexpectedly moves after table row removed
Beth Dakin
Comment 17 2013-01-17 15:01:40 PST
Thanks, Kevin! And Simon, I tried your experiment and the bug still did not repro. This particular issue does seem to be fixed.
Note You need to log in before you can comment on or make changes to this bug.