Fix offset issue of background-attachment:fixed on scroller

third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp

Index: third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp
diff --git a/third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp b/third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp
index 36909481eece9b1be6fc6e18a92d3d97a909a894..c10a2d255469345531b8a9000d61f34faad35e6f 100644
--- a/third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp
+++ b/third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp
@@ -119,16 +119,16 @@ LayoutSize calculateFillTileSize(const LayoutBoxModelObject& obj, const FillLaye
     return LayoutSize();
 }
 
-IntPoint accumulatedScrollOffset(const LayoutBoxModelObject& object, const LayoutBoxModelObject* container)
+IntPoint accumulatedScrollOffsetForFixedBackground(const LayoutBoxModelObject& object, const LayoutBoxModelObject* container)
 {
-    const LayoutBlock* block = object.isLayoutBlock() ? toLayoutBlock(&object) : object.containingBlock();
     IntPoint result;
-    while (block) {
+    if (&object == container)
+        return result;
+    for (const LayoutBlock* block = object.containingBlock(); block; block = block->containingBlock()) {
         if (block->hasOverflowClip())
             result += block->scrolledContentOffset();
         if (block == container)
             break;
-        block = block->containingBlock();
     }
     return result;
 }
@@ -257,7 +257,7 @@ void BackgroundImageGeometry::calculate(const LayoutBoxModelObject& obj, const L
                 viewportRect.setLocation(frameView->scrollPosition());
             // Compensate the translations created by ScrollRecorders.
             // TODO(trchen): Fix this for SP phase 2. crbug.com/529963.
-            viewportRect.moveBy(accumulatedScrollOffset(obj, paintContainer));
+            viewportRect.moveBy(accumulatedScrollOffsetForFixedBackground(obj, paintContainer));
         }
 
         if (paintContainer)