Shift flowthread-to-visual coordinate space conversion one level up in the tree.

third_party/WebKit/Source/core/layout/LayoutObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index 051799571158e80164251832a3a2a3e5358c8d66..dc29665879730ce38c0679345bdeb2bcaeade37b 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -2268,12 +2268,11 @@ void LayoutObject::mapLocalToAncestor(const LayoutBoxModelObject* ancestor, Tran
     }
 
     LayoutSize containerOffset = offsetFromContainer(o);
-    if (o->isLayoutFlowThread()) {
+    if (isLayoutFlowThread()) {
         // So far the point has been in flow thread coordinates (i.e. as if everything in
         // the fragmentation context lived in one tall single column). Convert it to a
-        // visual point now.
-        LayoutPoint pointInContainer = roundedLayoutPoint(transformState.mappedPoint()) + containerOffset;
-        containerOffset += o->columnOffset(pointInContainer);
+        // visual point now, since we're about to escape the flow thread.
+        containerOffset += columnOffset(roundedLayoutPoint(transformState.mappedPoint()));
     }
 
     // Text objects just copy their parent's computed style, so we need to ignore them.