Fix offset issue of background-attachment:fixed on scroller

third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/BackgroundImageGeometry.h"
 
 #include "core/frame/FrameView.h"
 #include "core/layout/LayoutBox.h"
 #include "core/layout/LayoutBoxModelObject.h"
 #include "core/layout/LayoutView.h"
@@ skipping 101 matching lines @@
             ? positioningAreaSize.height().toFloat() / imageIntrinsicSize.height() : 1;
         float scaleFactor = type == Contain ? std::min(horizontalScaleFactor, verticalScaleFactor) : std::max(horizontalScaleFactor, verticalScaleFactor);
         return LayoutSize(std::max<LayoutUnit>(1, imageIntrinsicSize.width() * scaleFactor), std::max<LayoutUnit>(1, imageIntrinsicSize.height() * scaleFactor));
     }
     }
 
     ASSERT_NOT_REACHED();
     return LayoutSize();
 }
 
-IntPoint accumulatedScrollOffset(const LayoutBoxModelObject& object, const LayoutBoxModelObject* container)
+IntPoint accumulatedScrollOffsetForFixedBackground(const LayoutBoxModelObject& object, const LayoutBoxModelObject* container)
 {
-    const LayoutBlock* block = object.isLayoutBlock() ? toLayoutBlock(&object) : object.containingBlock();
     IntPoint result;
-    while (block) {
+    if (&object == container)
+        return result;
+    for (const LayoutBlock* block = object.containingBlock(); block; block = block->containingBlock()) {
         if (block->hasOverflowClip())
             result += block->scrolledContentOffset();
         if (block == container)
             break;
-        block = block->containingBlock();
     }
     return result;
 }
 
 // When we match the sub-pixel fraction of the destination rect in a dimension, we
 // snap the same way. This commonly occurs when the background is meant to fill the
 // padding box but there's a border (which in Blink is always stored as an integer).
 // Otherwise we floor to avoid growing our tile size. Often these tiles are from a
 // sprite map, and bleeding adjactent sprites is visually worse than clipping the
 // intenteded one.
@@ skipping 108 matching lines @@
         setHasNonLocalGeometry();
 
         LayoutRect viewportRect = obj.viewRect();
         if (fixedBackgroundPaintsInLocalCoordinates(obj, globalPaintFlags)) {
             viewportRect.setLocation(LayoutPoint());
         } else {
             if (FrameView* frameView = obj.view()->frameView())
                 viewportRect.setLocation(frameView->scrollPosition());
             // Compensate the translations created by ScrollRecorders.
             // TODO(trchen): Fix this for SP phase 2. crbug.com/529963.
-            viewportRect.moveBy(accumulatedScrollOffset(obj, paintContainer));
+            viewportRect.moveBy(accumulatedScrollOffsetForFixedBackground(obj, paintContainer));
         }
 
         if (paintContainer)
             viewportRect.moveBy(LayoutPoint(-paintContainer->localToAbsolute(FloatPoint())));
 
         setDestRect(viewportRect);
         positioningAreaSize = destRect().size();
     }
 
     LayoutSize fillTileSize(calculateFillTileSize(positioningBox, fillLayer, positioningAreaSize));
@@ skipping 88 matching lines @@
     }
 
     if (fixedAttachment)
         useFixedAttachment(paintRect.location());
 
     clip(paintRect);
     pixelSnapGeometry();
 }
 
 } // namespace blink