Add in row offset if self-composited.

third_party/WebKit/Source/core/layout/LayoutBox.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBox.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 7fc355d09d9cc91257408c2eebb52256dbaf869e..10f59e680b0a811ed1e36ab67460f03eb7a871fc 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -2043,10 +2043,15 @@ bool LayoutBox::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ances
     bool ancestorSkipped;
     bool filterOrReflectionSkipped;
     LayoutObject* container = this->container(ancestor, &ancestorSkipped, &filterOrReflectionSkipped);
-    // Skip table row because cells and rows are in the same coordinate space, except when we're already at the ancestor.
-    if (container->isTableRow() && container != ancestor) {
-        DCHECK(isTableCell());
-        container = container->parent();
+    LayoutBox* tableRowContainer = nullptr;
+    // Skip table row because cells and rows are in the same coordinate space
+    // (see below, however for more comments about when |ancestor| is the table row).
+    if (container->isTableRow()) {
+        DCHECK(isTableCell() && parentBox() == container);
+        if (container != ancestor)
+            container = container->parent();
+        else
+            tableRowContainer = toLayoutBox(container);
     }
     if (!container)
         return true;
@@ -2063,12 +2068,15 @@ bool LayoutBox::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ances
         rect = LayoutRect(layer()->transform()->mapRect(enclosingIntRect(rect)));
     }
     LayoutPoint topLeft = rect.location();
-    // TODO(wkorman): Look into and document why this conditional is needed.
-    // Currently present following logic in PaintLayer::updateLayerPosition.
-    if (container->isBox())
+    if (container->isBox()) {
         topLeft.moveBy(topLeftLocation(toLayoutBox(container)));
-    else
+        // If the row is the ancestor, however, add its offset back in. In effect, this passes from the joint <td> / <tr>
+        // coordinate space to the parent space, then back to <tr> / <td>.
+        if (tableRowContainer)
+            topLeft.moveBy(-tableRowContainer->topLeftLocation(toLayoutBox(container)));
+    } else {
         topLeft.move(locationOffset());
+    }
 
     const ComputedStyle& styleToUse = styleRef();
     EPosition position = styleToUse.position();
@@ -4471,7 +4479,7 @@ LayoutPoint LayoutBox::topLeftLocation(const LayoutBox* flippedBlocksContainer)
     const LayoutBox* containerBox = flippedBlocksContainer ? flippedBlocksContainer : containingBlock();
     if (!containerBox || containerBox == this)
         return location();
-    return containerBox->flipForWritingModeForChild(this, location());
+    return containerBox->flipForWritingModeForChild(this, locationOverride ? *locationOverride : location());
 }
 
 bool LayoutBox::hasRelativeLogicalWidth() const