I was investigating the DCHECKs in layout_object.h(345), specifically in this testcase:
fast/scrolling/fractional-scroll-offset-fixed-position-non-composited.html

What's going on is that we never (re-)lay out the inner fixed-pos element. It seems what's going on is this:
- We do lay it out once, through the code called by LayoutNGBlockFlow::UpdateOutOfFlowBlockLayout, specifically in the second iteration of the loop at NGOutOfFlowLayoutPart::Run
- That's because contains_fixed_ is true when we call this code for the outer fixedpos element through LayoutBlock::LayoutPositionedObject
- contains_fixed_ is true because LayoutNGBlockFlow::UpdateOutOfFlowBlockLayout uses css_container->CanContainFixedPositionObjects
- Because we do process it here, we never call UseOldOutOfFlowPositioning on the inner fixedpos object
- Because we don't do that, we never insert the inner object to the viewport's list of positioned objects
- Because we don't do that, we do not lay it out when we have to

I think the real issue is that UpdateOutOfFlowBlockLayout needs to make sure that it lays itself out based on css_container->CanContain*, *but* for any descendants it needs to use this->CanContain*

Maybe we needs two passes through the OOF layout part, one for descendants, one for this?

Tentatively assigning to myself to look into that suggestion but I won't have time to work on this until at least tomorrow.