I suspect something is wrong in RenderLayer::rebuildZOrderLists
<rdar://problem/84316561>
Created attachment 441461 [details] Patch
Comment on attachment 441461 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=441461&action=review I think the real bug here is that RenderLayer::collectLayers() just early returns when establishesTopLayer() is true, so top layer layers never get any children. > Source/WebCore/rendering/RenderLayer.cpp:768 > + collectLayersForChildren(includeHiddenLayers, false, posZOrderList, negZOrderList, accumulatedDirtyFlags); This is called the "boolean trap": a true/false argument that is hard to understand here at the call site. We generally avoid this by using enums. > Source/WebCore/rendering/RenderLayer.cpp:803 > + auto startOfSorting = posZOrderList->end(); > + layer->collectLayersForChildren(includeHiddenLayers, true, posZOrderList, negZOrderList, accumulatedDirtyFlags); > + std::stable_sort(startOfSorting, posZOrderList->end(), compareZIndex); I don't think this is right. This will append all descendant layers to 'posZOrderList' but what needs to happen is that 'layer' here, which is a stacking context, builds its own positive and negative z-order lists. > Source/WebCore/rendering/RenderLayer.cpp:827 > + auto& layerList = (zIndex() >= 0 || hasTopLayerAncestor) ? positiveZOrderList : negativeZOrderList; Here all descendants of top layer layers append to the positiveZOrderList but this is wrong.
Created attachment 441466 [details] Patch
Committed r284314 (243110@main): <https://commits.webkit.org/243110@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 441466 [details].