Fix CSS reference filters with negative transformed children.

third_party/WebKit/Source/core/paint/FilterPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/FilterPainter.h"
 
 #include "core/paint/FilterEffectBuilder.h"
 #include "core/paint/LayerClipRecorder.h"
 #include "core/paint/PaintLayer.h"
 #include "platform/RuntimeEnabledFeatures.h"
@@ skipping 58 matching lines @@
         // layer's FilterEffectBuilder can have a stale representation of
         // the layer's filter. See crbug.com/502026.
         if (compositorFilterOperations.isEmpty())
             return;
         LayoutRect visualBounds(rootRelativeBounds);
         if (layer.enclosingPaginationLayer()) {
             // Filters are set up before pagination, so we need to make the bounding box visual on our own.
             visualBounds.moveBy(-offsetFromRoot);
             layer.convertFromFlowThreadToVisualBoundingBoxInAncestor(paintingInfo.rootLayer, visualBounds);
         }
-        context.getPaintController().createAndAppend<BeginFilterDisplayItem>(*m_layoutObject, std::move(imageFilter), FloatRect(visualBounds), std::move(compositorFilterOperations));
+        FloatPoint origin(offsetFromRoot);
+        context.getPaintController().createAndAppend<BeginFilterDisplayItem>(*m_layoutObject, std::move(imageFilter), FloatRect(visualBounds), origin, std::move(compositorFilterOperations));
     }
 
     m_filterInProgress = true;
 }
 
 FilterPainter::~FilterPainter()
 {
     if (!m_filterInProgress)
         return;
 
     m_context.getPaintController().endItem<EndFilterDisplayItem>(*m_layoutObject);
 }
 
 } // namespace blink