Fix a case where the accessible bounding box of an inline text box was wrong.

third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp

 /*
  * Copyright (C) 2013, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 48 matching lines @@
     AXObject::detach();
     m_inlineTextBox = nullptr;
 }
 
 void AXInlineTextBox::getRelativeBounds(AXObject** outContainer, FloatRect& outBoundsInContainer, SkMatrix44& outContainerTransform) const
 {
     *outContainer = nullptr;
     outBoundsInContainer = FloatRect();
     outContainerTransform.setIdentity();
 
-    if (!m_inlineTextBox)
+    if (!m_inlineTextBox || !parentObject() || !parentObject()->getLayoutObject())
         return;
 
     *outContainer = parentObject();
     outBoundsInContainer = FloatRect(m_inlineTextBox->localBounds());
+
+    // Subtract the local bounding box of the parent because they're
+    // both in the same coordinate system.
+    LayoutObject* parentLayoutObject = parentObject()->getLayoutObject();
+    FloatRect parentBoundingBox = parentLayoutObject->localBoundingBoxRectForAccessibility();
+    outBoundsInContainer.moveBy(-parentBoundingBox.location());
 }
 
 bool AXInlineTextBox::computeAccessibilityIsIgnored(IgnoredReasons* ignoredReasons) const
 {
     AXObject* parent = parentObject();
     if (!parent)
         return false;
 
     if (!parent->accessibilityIsIgnored())
         return false;
@@ skipping 92 matching lines @@
     if (previousOnLine)
         return m_axObjectCache->getOrCreate(previousOnLine.get());
 
     if (!m_inlineTextBox->isFirst())
         return 0;
 
     return parentObject()->previousOnLine();
 }
 
 } // namespace blink