Use the window coordinate for the autofill bounds.

components/autofill/content/renderer/autofill_agent.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/content/renderer/autofill_agent.h"
 
 #include <tuple>
 
 #include "base/auto_reset.h"
 #include "base/bind.h"
@@ skipping 713 matching lines @@
                            &data_list_labels);
     TrimStringVectorForIPC(&data_list_values);
     TrimStringVectorForIPC(&data_list_labels);
   }
 
   is_popup_possibly_visible_ = true;
   Send(new AutofillHostMsg_SetDataList(routing_id(),
                                        data_list_values,
                                        data_list_labels));
 
+  blink::WebRect bounding_box_in_window = element_.boundsInViewport();
+  render_frame()->GetRenderView()->convertViewportToWindow(
+      &bounding_box_in_window);
+
   Send(new AutofillHostMsg_QueryFormFieldAutofill(
       routing_id(), autofill_query_id_, form, field,
-      gfx::RectF(element_.boundsInViewport())));
+      gfx::RectF(bounding_box_in_window)));
 }
 
 void AutofillAgent::FillFieldWithValue(const base::string16& value,
                                        WebInputElement* node) {
   base::AutoReset<bool> auto_reset(&ignore_text_changes_, true);
   node->setEditingValue(value.substr(0, node->maxLength()));
 }
 
 void AutofillAgent::PreviewFieldWithValue(const base::string16& value,
                                           WebInputElement* node) {
@@ skipping 65 matching lines @@
 
 void AutofillAgent::LegacyAutofillAgent::OnDestruct() {
   // No-op. Don't delete |this|.
 }
 
 void AutofillAgent::LegacyAutofillAgent::FocusChangeComplete() {
   agent_->FocusChangeComplete();
 }
 
 }  // namespace autofill