Clip abspos descendants correctly in all columns (not just the first).

third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp

Index: third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp b/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
index e073f78a84b14ccc67814990d484ab39f2a8d492..4b5881f285d29b566dcb162032dbd63033e7e6fe 100644
--- a/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
@@ -296,6 +296,23 @@ bool LayoutMultiColumnFlowThread::isPageLogicalHeightKnown() const
     return false;
 }
 
+LayoutSize LayoutMultiColumnFlowThread::offsetFromContainer(const LayoutObject* o, const LayoutPoint& point, bool* offsetDependsOnPoint) const
+{
+    ASSERT(o == container());
+
+    // So far the point has been in flow thread coordinates (i.e. as if everything in
+    // the fragmentation context lived in one tall single column). Convert it to a
+    // visual point now.
+
+    // TODO(mstensho): It's bad to assume that we want offsetFromContainer() to convert to visual
+    // coordinates. See LayoutBoxModelObject::mapAbsoluteToLocalPoint(). We really only want such
+    // conversions when walking *upwards* in the tree, but offsetFromContainer() has no idea why
+    // it's being called.
+    if (offsetDependsOnPoint)
+        *offsetDependsOnPoint = true;
+    return columnOffset(point) + topLeftLocationOffset();
+}
+
 LayoutSize LayoutMultiColumnFlowThread::flowThreadTranslationAtOffset(LayoutUnit offsetInFlowThread) const
 {
     LayoutMultiColumnSet* columnSet = columnSetAtBlockOffset(offsetInFlowThread);