Bug 36686

Summary: Handling of fixed pos state in mapLocalToContainer() may be wrong
Product: WebKit Reporter: Simon Fraser (smfr) <simon.fraser>
Component: Layout and RenderingAssignee: Simon Fraser (smfr) <simon.fraser>
Status: NEW    
Severity: Normal CC: benjamin, hausmann, kenneth
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Bug Depends on: 37637    
Bug Blocks: 36652    
Attachments:
Description Flags
Test case
none
Quick patch
none
New test case without transormation none

Simon Fraser (smfr)
Reported 2010-03-26 18:11:32 PDT
mapLocalToContainer() may do the wrong thing when called directly on a fixed, transformed element, because 'fixed' on entry is false, and will stay false when we hit the hasTransform test.
Attachments
Test case (768 bytes, text/html)
2010-03-29 08:39 PDT, Benjamin Poulain 		no flags
Details
Quick patch (2.72 KB, patch)
2010-03-29 09:17 PDT, Benjamin Poulain 		no flags
DetailsFormatted DiffDiff
New test case without transormation (882 bytes, text/html)
2010-03-29 12:48 PDT, Benjamin Poulain 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Simon Fraser (smfr)
Comment 1 2010-03-26 18:15:15 PDT
See bug 36652 also.
Benjamin Poulain
Comment 2 2010-03-29 05:36:26 PDT
I agree, this looks wrong. I will do a pixel test for it.
Benjamin Poulain
Comment 3 2010-03-29 08:39:50 PDT
Created attachment 51916 [details] Test case Another test case, this one should have the problems of computeRectForRepaint() and mapLocalToContainer().
Benjamin Poulain
Comment 4 2010-03-29 09:17:26 PDT
Created attachment 51919 [details] Quick patch Quick fix. It passes the test and solve https://bug-36652-attachments.webkit.org/attachment.cgi?id=51750 But curiously, not https://bug-36686-attachments.webkit.org/attachment.cgi?id=51916 although the update rect is now at the correct position. I need to investigate why the previous area is not repainted correctly.
Benjamin Poulain
Comment 5 2010-03-29 12:48:41 PDT
Created attachment 51951 [details] New test case without transormation Apparently, the previous test case also show another, possibly unrelated, bug. This attachment is similar to https://bugs.webkit.org/attachment.cgi?id=51916 without the transformation. The bug is still present. I think about submitting this patch: https://bugs.webkit.org/attachment.cgi?id=51919 with this test: https://bug-36652-attachments.webkit.org/attachment.cgi?id=51750 for this bug report. And create a new bug report for https://bugs.webkit.org/attachment.cgi?id=51916 which look a bit more urgent than the current task. Simon, is that ok with you?
Simon Fraser (smfr)
Comment 6 2010-03-29 13:46:08 PDT
I think we should fix the non-transformed bug (your last testcase) first.
Benjamin Poulain
Comment 7 2010-03-29 14:39:55 PDT
(In reply to comment #6) > I think we should fix the non-transformed bug (your last testcase) first. I agree. I have created the bug report https://bugs.webkit.org/show_bug.cgi?id=36783 for this case. I might be able to investigate it tomorrow. I will also make a proper patch for 36686 so I have a chance to close 36652 this week.
Kenneth Rohde Christiansen
Comment 8 2010-05-07 07:11:11 PDT
(In reply to comment #7) > (In reply to comment #6) > > I think we should fix the non-transformed bug (your last testcase) first. > > I agree. I have created the bug report > https://bugs.webkit.org/show_bug.cgi?id=36783 for this case. > > I might be able to investigate it tomorrow. I will also make a proper patch for > 36686 so I have a chance to close 36652 this week. Any work on this?
Note You need to log in before you can comment on or make changes to this bug.