This test link is reduced from a wordpress admin page where it places a admin bar with a position: fixed; on it. Load the test page. Select all the text, copy and then paste it below the existing text. Then select undo (Command-Z) and the dark bar at the top will jump to the 0,0 coordinate of the textarea when it should stay where it is. I believe there's other triggers since I've had this come up in other places in wordpress and another site editor.
Created attachment 167430 [details] Before
Created attachment 167432 [details] after
Removing the position: fixed; from the top div with Web Inspector causes the glitch to not occur.
Likely related to Bug 98579.
After pasting, pressing the delete key until a line is completely removed will also trigger the glitch.
In debug builds, an assertion fails: ASSERTION FAILED: enclosingIntRect(rendererMappedResult) == enclosingIntRect(FloatQuad(result).boundingBox()) /Users/ap/Safari/OpenSource/Source/WebCore/rendering/RenderGeometryMap.cpp(85) : WebCore::FloatRect WebCore::RenderGeometryMap::absoluteRect(const WebCore::FloatRect &) const 1 0x10aa81d19 WebCore::RenderGeometryMap::absoluteRect(WebCore::FloatRect const&) const 2 0x10aacea1e WebCore::RenderLayerCompositor::addToOverlapMap(WebCore::RenderLayerCompositor::OverlapMap&, WebCore::RenderLayer*, WebCore::IntRect&, bool&) 3 0x10aacc912 WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::RenderLayerCompositor::OverlapMap*, WebCore::CompositingState&, bool&, bool&) 4 0x10aacc7ef WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::RenderLayerCompositor::OverlapMap*, WebCore::CompositingState&, bool&, bool&) 5 0x10aacc7ef WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::RenderLayerCompositor::OverlapMap*, WebCore::CompositingState&, bool&, bool&) 6 0x10aacbd84 WebCore::RenderLayerCompositor::updateCompositingLayers(WebCore::CompositingUpdateType, WebCore::RenderLayer*) 7 0x10aa9fd6e WebCore::RenderLayer::updateCompositingLayersAfterScroll() 8 0x10aa9f8a3 WebCore::RenderLayer::scrollTo(int, int) 9 0x10aaa20ae WebCore::RenderLayer::setScrollOffset(WebCore::IntPoint const&) 10 0x10acdf84d WebCore::ScrollableArea::scrollPositionChanged(WebCore::IntPoint const&)
<rdar://problem/12454637>
I am going to fix the assertion via bug 101292.
I can no longer reproduce this bug on TOT. Kevin, do you still see this?
What if you disable the compositing-for-fixed stuff?
(In reply to comment #9) > I can no longer reproduce this bug on TOT. Kevin, do you still see this? I no longer see this specific case, but I do see a similar issue in another area of wordpress where a table row is removed via javascript and the page scrolls back to the top, but the fixed div jumps down the page until you click. I'll upload a before/after.
Created attachment 183269 [details] Table Row Before
Created attachment 183270 [details] Table Row After
I've set up a wordpress test area if you want to login and take a look. Just respond here or send me an email directly for the access information and instructions to trigger the bug.
This bug seems to happen in a different range, so I should probably open a new bug for it.
OK, if you're interested, head over to: Bug 107179 - REGRESSION (r139554-r139561): Fixed position div unexpectedly moves after table row removed
Thanks, Kevin! And Simon, I tried your experiment and the bug still did not repro. This particular issue does seem to be fixed.