Unify code paths for fixed and absolutely positioned objects in accumulateOffsetTowardsAncestor().

LayoutTests/fast/multicol/transform-with-fixedpos-crash.html

Index: LayoutTests/fast/multicol/transform-with-fixedpos-crash.html
diff --git a/LayoutTests/fast/multicol/span/sole-svg-spanner-with-foreignObject-crash.html b/LayoutTests/fast/multicol/transform-with-fixedpos-crash.html
similarity index 61%
copy from LayoutTests/fast/multicol/span/sole-svg-spanner-with-foreignObject-crash.html
copy to LayoutTests/fast/multicol/transform-with-fixedpos-crash.html
index e196e060d739265cc9c500c025895f14d6915903..f94d2ec02276318f519e3b8484e8ec524501e413 100644
--- a/LayoutTests/fast/multicol/span/sole-svg-spanner-with-foreignObject-crash.html
+++ b/LayoutTests/fast/multicol/transform-with-fixedpos-crash.html
@@ -5,7 +5,7 @@
 </script>
 <p>PASS if no crash or assertion failure.</p>

[Julien - ping for review, 2015/07/29 23:10:52]

Let's add a description of what is tested.

[mstensho (USE GERRIT), 2015/07/30 09:32:06]

Done.

 <div style="-webkit-column-count:2;">
-    <svg style="display:block; -webkit-column-span:all;">
-        <foreignObject>&nbsp;</foreignObject>
-    </svg>
+    <div style="-webkit-transform:rotate(4deg);">
+        <div style="position:fixed;"></div>

[Julien - ping for review, 2015/07/29 23:10:52]

Ideally we would want to test that we get the *correct* result as assertions are
disabled in release and it's also a more meaningful information that not
crashing.

[mstensho (USE GERRIT), 2015/07/30 09:32:06]

Done.

Made a reftest instead. Note that there are still a bug with fixed-positioneds
here, not related to this part of the code, so the test is somewhat crippled, in
that it's boring enough to let everything take place in the first column, to
avoid exposing other said bug. See bug 515415.

+    </div>
 </div>