Fix LayoutObject::mapLocalToAncestor() for fixed under absolute

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 231 matching lines @@
     m_paintOffset +=
         toLayoutBox(parentState.m_currentObject).contentBoxOffset();
     // a LayoutView paints with a defined size but a pixel-rounded offset.
     m_paintOffset = LayoutSize(roundedIntSize(m_paintOffset));
     return;
   }
 
   EPosition position = m_currentObject.styleRef().position();
 
   if (position == FixedPosition) {
-    if (m_paintInvalidationContainer != m_currentObject.view() &&
-        m_paintInvalidationContainer->view() == m_currentObject.view()) {
-      // TODO(crbug.com/598762): localToAncestorPoint() is incorrect for
-      // fixed-position when paintInvalidationContainer is under the containing
-      // LayoutView.
-      m_cachedOffsetsEnabled = false;
-      return;
-    }
     // Use slow path to get the offset of the fixed-position, and enable fast
     // path for descendants.
     FloatPoint fixedOffset = m_currentObject.localToAncestorPoint(
         FloatPoint(), m_paintInvalidationContainer, TraverseDocumentBoundaries);
     if (m_paintInvalidationContainer->isBox()) {
       const LayoutBox* box = toLayoutBox(m_paintInvalidationContainer);
       if (box->hasOverflowClip())
         fixedOffset.move(box->scrolledContentOffset());
     }
     m_paintOffset = LayoutSize(fixedOffset.x(), fixedOffset.y());
@@ skipping 364 matching lines @@
 }
 
 void PaintInvalidatorContextAdapter::mapLocalRectToPaintInvalidationBacking(
     const LayoutObject& object,
     LayoutRect& rect) const {
   DCHECK(&object == &m_paintInvalidationState.currentObject());
   m_paintInvalidationState.mapLocalRectToPaintInvalidationBacking(rect);
 }
 
 }  // namespace blink