Bug 36686 - Handling of fixed pos state in mapLocalToContainer() may be wrong
Summary: Handling of fixed pos state in mapLocalToContainer() may be wrong
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Simon Fraser (smfr)
URL:
Keywords:
Depends on: 37637
Blocks: 36652
  Show dependency tree / graph
 
Reported: 2010-03-26 18:11 PDT by Simon Fraser (smfr)
Modified: 2011-04-19 05:15 PDT (History)
3 users (show)

See Also:

Attachments
Test case (768 bytes, text/html)
2010-03-29 08:39 PDT, Benjamin Poulain 		no flags Details
Quick patch (2.72 KB, patch)
2010-03-29 09:17 PDT, Benjamin Poulain 		no flags Details | Formatted Diff | Diff
New test case without transormation (882 bytes, text/html)
2010-03-29 12:48 PDT, Benjamin Poulain 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Simon Fraser (smfr) 2010-03-26 18:11:32 PDT 
mapLocalToContainer() may do the wrong thing when called directly on a fixed, transformed element, because 'fixed' on entry is false, and will stay false when we hit the hasTransform test.
Comment 1 Simon Fraser (smfr) 2010-03-26 18:15:15 PDT 
See bug 36652 also.
Comment 2 Benjamin Poulain 2010-03-29 05:36:26 PDT 
I agree, this looks wrong.
I will do a pixel test for it.
Comment 3 Benjamin Poulain 2010-03-29 08:39:50 PDT 
Created attachment 51916 [details]
Test case

Another test case, this one should have the problems of computeRectForRepaint() and mapLocalToContainer().
Comment 4 Benjamin Poulain 2010-03-29 09:17:26 PDT 
Created attachment 51919 [details]
Quick patch

Quick fix.
It passes the test and solve https://bug-36652-attachments.webkit.org/attachment.cgi?id=51750
But curiously, not https://bug-36686-attachments.webkit.org/attachment.cgi?id=51916 although the update rect is now at the correct position. I need to investigate why the previous area is not repainted correctly.
Comment 5 Benjamin Poulain 2010-03-29 12:48:41 PDT 
Created attachment 51951 [details]
New test case without transormation

Apparently, the previous test case also show another, possibly unrelated, bug.

This attachment is similar to https://bugs.webkit.org/attachment.cgi?id=51916 without the transformation. The bug is still present.

I think about submitting this patch: https://bugs.webkit.org/attachment.cgi?id=51919 with this test: https://bug-36652-attachments.webkit.org/attachment.cgi?id=51750 for this bug report. And create a new bug report for https://bugs.webkit.org/attachment.cgi?id=51916 which look a bit more urgent than the current task. Simon, is that ok with you?
Comment 6 Simon Fraser (smfr) 2010-03-29 13:46:08 PDT 
I think we should fix the non-transformed bug (your last testcase) first.
Comment 7 Benjamin Poulain 2010-03-29 14:39:55 PDT 
(In reply to comment #6)
> I think we should fix the non-transformed bug (your last testcase) first.

I agree. I have created the bug report https://bugs.webkit.org/show_bug.cgi?id=36783 for this case.

I might be able to investigate it tomorrow. I will also make a proper patch for 36686 so I have a chance to close 36652 this week.
Comment 8 Kenneth Rohde Christiansen 2010-05-07 07:11:11 PDT 
(In reply to comment #7)
> (In reply to comment #6)
> > I think we should fix the non-transformed bug (your last testcase) first.
> 
> I agree. I have created the bug report
> https://bugs.webkit.org/show_bug.cgi?id=36783 for this case.
> 
> I might be able to investigate it tomorrow. I will also make a proper patch for
> 36686 so I have a chance to close 36652 this week.

Any work on this?