Fix a case where the accessible bounding box of an inline text box was wrong.

third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp

Index: third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
diff --git a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
index 925239303cc7af3fd96b5d803a2d546031efdd27..a2cf0fc70a4f9df19040df8c1e2aba88368a8195 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
@@ -66,11 +66,17 @@ void AXInlineTextBox::getRelativeBounds(AXObject** outContainer, FloatRect& outB
     outBoundsInContainer = FloatRect();
     outContainerTransform.setIdentity();
 
-    if (!m_inlineTextBox)
+    if (!m_inlineTextBox || !parentObject() || !parentObject()->getLayoutObject())
         return;
 
     *outContainer = parentObject();
     outBoundsInContainer = FloatRect(m_inlineTextBox->localBounds());
+
+    // Subtract the local bounding box of the parent because they're
+    // both in the same coordinate system.
+    LayoutObject* parentLayoutObject = parentObject()->getLayoutObject();
+    FloatRect parentBoundingBox = parentLayoutObject->localBoundingBoxRectForAccessibility();
+    outBoundsInContainer.moveBy(-parentBoundingBox.location());
 }
 
 bool AXInlineTextBox::computeAccessibilityIsIgnored(IgnoredReasons* ignoredReasons) const