Don't adjust for scrolling of the ancestor, rather than un-adjusting for it later.

third_party/WebKit/Source/core/layout/LayoutObject.h

 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 1124 matching lines @@
     // coordinate space. This method deals with outlines and overflow.
     virtual LayoutRect absoluteClippedOverflowRect() const;
 
     // Returns the rect that should have paint invalidated whenever this object changes. The rect is in the object's
     // local coordinate space. This is for non-SVG objects and LayoutSVGRoot only. SVG objects (except LayoutSVGRoot)
     // should use paintInvalidationRectInLocalSVGCoordinates() and map with SVG transforms instead.
     virtual LayoutRect localOverflowRectForPaintInvalidation() const;
 
     // Given a rect in the object's coordinate space, mutates the rect into one representing the size of its visual painted
     // output as if |ancestor| was the root of the page: the rect is modified by any intervening clips, transforms
-    // and scrolls between |this| and |ancestor|, but not any above |ancestor|.
+    // and scrolls between |this| and |ancestor| (not inclusive of |ancestor|), but not any above |ancestor|.
     // The output is in the physical, painted coordinate pixel space of |ancestor|.
-    // Overflow clipping is *not* applied for |ancestor| itself if |ancestor| scrolls overflow.
+    // Overflow clipping and scrolling is *not* applied for |ancestor| itself if |ancestor| scrolls overflow.
     // The output rect is suitable for purposes such as paint invalidation.
     //
     // If visualRectFlags has the EdgeInclusive bit set, clipping operations will use
     // LayoutRect::inclusiveIntersect, and the return value of inclusiveIntersect will be propagated
     // to the return value of this method.  Otherwise, clipping operations will use LayoutRect::intersect,
     // and the return value will be true only if the clipped rect has non-zero area.
     // See the documentation for LayoutRect::inclusiveIntersect for more information.
     virtual bool mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ancestor, LayoutRect&, VisualRectFlags = DefaultVisualRectFlags) const;
 
     // Return the offset to the column in which the specified point (in flow-thread coordinates)
@@ skipping 1029 matching lines @@
 void showTree(const blink::LayoutObject*);
 void showLineTree(const blink::LayoutObject*);
 void showLayoutTree(const blink::LayoutObject* object1);
 // We don't make object2 an optional parameter so that showLayoutTree
 // can be called from gdb easily.
 void showLayoutTree(const blink::LayoutObject* object1, const blink::LayoutObject* object2);
 
 #endif
 
 #endif // LayoutObject_h