This is pretty serious so we don't want to ship a beta. I should have a fix ready soon though.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a226f0e367ee7e064cc398d0b76d347d53103295

commit a226f0e367ee7e064cc398d0b76d347d53103295
Author: bokan <bokan@chromium.org>
Date: Thu Nov 24 05:10:30 2016

LayoutView's paint layer should clip to the full viewport size.

This patch makes it so that the LayoutView's painting size is always at least
the size of the layout viewport. Today (without root-layer-scrolls), the
LayoutView's PaintLayer (and its parent root content layer) is sized to contain
all the document's content and is clipped and scrolled by the PaintLayers
belonging to the Frame's PaintLayerCompositor (the Frame Scroll and Clipping
layers).  This is problematic if the content is smaller than the viewport since
position: fixed elements are attached to the viewport but are not counted as
part of the LayoutView's "layout overflow".

This occurs in two situations (both occur only on Android):

1.  Bug 666806  - With inert top controls on and the top controls hidden, a page
whose document is empty (for e.g.) will produce a LayoutView layer whose height
is the height of the viewport minus the height of the top controls. This means
bottom position: fixed elements will get clipped.

2.  Bug 436871  - If the content on a page is wider than the ICB, Chrome will
grow the layout viewport until its width covers all the content (or the minimum
scale is reached), keeping the aspect-ratio fixed. When this happens, the
layout viewport can become taller than the content resulting in clipping of
bottom position: fixed elements. (This is related to  crbug.com/492871 ).

This patch fixes both issues.

BUG= 666806 , 436871 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2519163003
Cr-Commit-Position: refs/heads/master@{#434303}

[modify] https://crrev.com/a226f0e367ee7e064cc398d0b76d347d53103295/third_party/WebKit/Source/core/layout/LayoutView.cpp
[modify] https://crrev.com/a226f0e367ee7e064cc398d0b76d347d53103295/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
[modify] https://crrev.com/a226f0e367ee7e064cc398d0b76d347d53103295/third_party/WebKit/Source/core/paint/PaintLayer.cpp
[modify] https://crrev.com/a226f0e367ee7e064cc398d0b76d347d53103295/third_party/WebKit/Source/web/tests/VisualViewportTest.cpp
[modify] https://crrev.com/a226f0e367ee7e064cc398d0b76d347d53103295/third_party/WebKit/Source/web/tests/WebFrameTest.cpp

Issue should be fixed on ToT, will request merge once I verify it in Canary.

Fix confirmed. Requesting merge.

Your change meets the bar and is auto-approved for M56 (branch: 2924)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e0ebf90514da284bba75b6ddb72a7f043b8ce701

commit e0ebf90514da284bba75b6ddb72a7f043b8ce701
Author: David Bokan <bokan@chromium.org>
Date: Fri Nov 25 21:03:19 2016

LayoutView's paint layer should clip to the full viewport size.

This patch makes it so that the LayoutView's painting size is always at least
the size of the layout viewport. Today (without root-layer-scrolls), the
LayoutView's PaintLayer (and its parent root content layer) is sized to contain
all the document's content and is clipped and scrolled by the PaintLayers
belonging to the Frame's PaintLayerCompositor (the Frame Scroll and Clipping
layers).  This is problematic if the content is smaller than the viewport since
position: fixed elements are attached to the viewport but are not counted as
part of the LayoutView's "layout overflow".

This occurs in two situations (both occur only on Android):

1.  Bug 666806  - With inert top controls on and the top controls hidden, a page
whose document is empty (for e.g.) will produce a LayoutView layer whose height
is the height of the viewport minus the height of the top controls. This means
bottom position: fixed elements will get clipped.

2.  Bug 436871  - If the content on a page is wider than the ICB, Chrome will
grow the layout viewport until its width covers all the content (or the minimum
scale is reached), keeping the aspect-ratio fixed. When this happens, the
layout viewport can become taller than the content resulting in clipping of
bottom position: fixed elements. (This is related to  crbug.com/492871 ).

This patch fixes both issues.

BUG= 666806 , 436871 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2519163003
Cr-Commit-Position: refs/heads/master@{#434303}
(cherry picked from commit a226f0e367ee7e064cc398d0b76d347d53103295)

Review URL: https://codereview.chromium.org/2531913002 .

Cr-Commit-Position: refs/branch-heads/2924@{#99}
Cr-Branched-From: 3a87aecc31cd1ffe751dd72c04e5a96a1fc8108a-refs/heads/master@{#433059}

[modify] https://crrev.com/e0ebf90514da284bba75b6ddb72a7f043b8ce701/third_party/WebKit/Source/core/layout/LayoutView.cpp
[modify] https://crrev.com/e0ebf90514da284bba75b6ddb72a7f043b8ce701/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
[modify] https://crrev.com/e0ebf90514da284bba75b6ddb72a7f043b8ce701/third_party/WebKit/Source/core/paint/PaintLayer.cpp
[modify] https://crrev.com/e0ebf90514da284bba75b6ddb72a7f043b8ce701/third_party/WebKit/Source/web/tests/VisualViewportTest.cpp
[modify] https://crrev.com/e0ebf90514da284bba75b6ddb72a7f043b8ce701/third_party/WebKit/Source/web/tests/WebFrameTest.cpp