Created attachment 162092 [details] Manual test case When refactoring the clamping logic into clampScrollOffset as part of r120832, the different clipping logics were consolidated into the new function. Unfortunately the old code would wrongly clamp the values: int x = min(max(scrollOffset.width(), 0), maxX); int y = min(max(scrollOffset.height(), 0), maxY); Note that because we apply the min last, we cannot guarantee that x and y are positive as nothing prevents maxX / maxY from being negative. r120832 exposed the bug to RenderLayer::scrollRectToVisible which was doing the proper clamping.
Created attachment 162097 [details] Proposed fix: Apply the max last to ensure positive offsets.
Comment on attachment 162097 [details] Proposed fix: Apply the max last to ensure positive offsets. Clearing flags on attachment: 162097 Committed r127520: <http://trac.webkit.org/changeset/127520>
All reviewed patches have been landed. Closing bug.