Compute the popup location/size correctly when use-zoom-for-dsf is enabled.

third_party/WebKit/Source/web/PopupMenuImpl.cpp

 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "web/PopupMenuImpl.h"
 
 #include "core/HTMLNames.h"
 #include "core/css/CSSFontSelector.h"
 #include "core/dom/ElementTraversal.h"
@@ skipping 271 matching lines @@
         if (isHTMLOptionElement(child))
             addOption(context, toHTMLOptionElement(child));
         else if (isHTMLOptGroupElement(child))
             addOptGroup(context, toHTMLOptGroupElement(child));
         else if (isHTMLHRElement(child))
             addSeparator(context, toHTMLHRElement(child));
     }
     context.finishGroupIfNecessary();
     PagePopupClient::addString("],\n", data);
 
+    addProperty("anchorRectInScreen", anchorRectInScreen, data);
     float zoom = zoomFactor();
-    addProperty("anchorRectInScreen", anchorRectInScreen, data);
-    addProperty("zoomFactor", zoom, data);
+    IntRect inScreen = m_chromeClient->viewportToScreen(IntRect(0, 0, 100, 0));
+    float scaleFactor = 100.f / inScreen.width();
+    addProperty("zoomFactor", zoom / scaleFactor, data);
     bool isRTL = !ownerStyle->isLeftToRightDirection();
     addProperty("isRTL", isRTL, data);
     addProperty("paddingStart", isRTL ? ownerElement.clientPaddingRight().toDouble() / zoom : ownerElement.clientPaddingLeft().toDouble() / zoom, data);
     PagePopupClient::addString("};\n", data);
     data->append(Platform::current()->loadResource("pickerCommon.js"));
     data->append(Platform::current()->loadResource("listPicker.js"));
     PagePopupClient::addString("</script></body>\n", data);
 }
 
 void PopupMenuImpl::addElementStyle(ItemIterationContext& context, HTMLElement& element)
@@ skipping 222 matching lines @@
 
 void PopupMenuImpl::disconnectClient()
 {
     m_ownerElement = nullptr;
     // Cannot be done during finalization, so instead done when the
     // layout object is destroyed and disconnected.
     dispose();
 }
 
 } // namespace blink