Go to an instagram page with photos. Scroll down. Click on a photo. The fixed overlay that comes up is offset by your scroll position.
Created attachment 366131 [details] Reduction
rdar://problem/49100304
The site basically does: document.body.style.top = -window.scrollY + 'px'; document.body.style.position = "fixed"; // show fixed overlay so we get a scrolling tree commit that has a new layout viewport (goes from origin 0,scrollTop to 0,0) and a new scrollPosition. In this case, we have to clobber the scrolling thread's notion of scroll position because the document suddenly became non-scrollable, so this has to act like a requestedScrollPosition change.
Ah, this is about the race between the scrolling tree commit and calling ScrollingTree::applyLayerPositions() on the main thread. I might have to have the main thread wait on the commit.
Created attachment 366149 [details] Patch
I'll try to make the attachment into a test case.
Landed with test: https://trac.webkit.org/r243607