Fix LayoutObject::mapLocalToAncestor() for fixed under absolute
When mapping from a fixed to an absolute ancestor, mapLocalToAncestor()
deals with the case that the ancestor is skipped by fixed's container,
but forgot to adjust fixed-position offset.
Also fix the similar issue of mapAncestorToLocal().
BUG=
656172
TEST=MapCoordinatesTest.FixedPosIn(Fixed|Absolute)PosScrollView
TEST=paint/invalidation/fixed-with-border-under-composited-absolute-scrolled.html
NOTRY=true (to workaround OOM of android bot)
Committed:
https://crrev.com/a4969c67949640d4a7fbe2a2ea91cb4506aaa218
Cr-Commit-Position: refs/heads/master@{#427177}