It looks like composited sticky position not having viewport constraints hooked up properly. Investigating.

The scroller is non-composited, therefore the sticky layer doesn't use sticky constrained layer either, which is working as intended.

However the sticky descendant was not invalidated nor have paint offset updated properly upon scroll, even in non-BGPT mode.

I uploaded a test simplified from a mixed-composited-nested-sticky-overflow-scroller.html

Repro: Open test26.html and scroll the scroller.
Expected result: The green box should not move.
Actual result: The green box scrolled along. Bonus: With a DCHECK build, toggling the background color of the green box to force a repaint, the paint offset under-invalidation will be detected by a DCHECK.

[1:1:0820/163941.707652:FATAL:find_paint_offset_and_visual_rect_needing_update.h(46)] Check failed: *&old_paint_offset_ == *&paint_offset. Property was updated without the layout object ("LayoutBlockFlow (sticky positioned) DIV class='outersticky'") needing a paint property update.

Promoting to P1 since it also breaks vanilla.

Deleted: test26.html 372 bytes

test26.html 372 bytes View Download

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/47afbe8ea56346b06f85309a351eb9de841e8c12

commit 47afbe8ea56346b06f85309a351eb9de841e8c12
Author: Tien-Ren Chen <trchen@chromium.org>
Date: Thu Aug 23 02:23:02 2018

[Blink] Fix under-invalidation for sticky descendants of non-composited scoller

Sticky descendants need to re-compute paint offset upon scrolled. Beside
fixing the under-invalidation, this CL also reduced the strength of the
invalidation so instead of full paint invalidation it only needs a paint
offset check.

BUG= 874675 

Cq-Include-Trybots: luci.chromium.try:linux-blink-gen-property-trees;luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I0e4ab3b667a6f06bfe3c584285dc2e31fa4ea7c2
Reviewed-on: https://chromium-review.googlesource.com/1182668
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Tien-Ren Chen <trchen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#585370}
[modify] https://crrev.com/47afbe8ea56346b06f85309a351eb9de841e8c12/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-gen-property-trees
[modify] https://crrev.com/47afbe8ea56346b06f85309a351eb9de841e8c12/third_party/blink/renderer/core/paint/paint_and_raster_invalidation_test.cc
[modify] https://crrev.com/47afbe8ea56346b06f85309a351eb9de841e8c12/third_party/blink/renderer/core/paint/paint_layer_scrollable_area.cc