Fix LayoutObject::mapLocalToAncestor() for fixed under absolute

third_party/WebKit/Source/core/layout/LayoutObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index 0ae7cb6b3efb9b4e07af42ed1c3f3672c0230d8b..e00f014f85e61c347631412ea6360a99c66d6f7b 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -2093,6 +2093,14 @@ void LayoutObject::mapLocalToAncestor(const LayoutBoxModelObject* ancestor,
     transformState.move(-containerOffset.width(), -containerOffset.height(),
                         preserve3D ? TransformState::AccumulateTransform
                                    : TransformState::FlattenTransform);
+    // If the ancestor is fixed, then the rect is already in its coordinates so
+    // doesn't need viewport-adjusting.
+    if (ancestor->style()->position() != FixedPosition && o->isLayoutView() &&
+        styleRef().position() == FixedPosition) {
+      LayoutRect rect;
+      toLayoutView(o)->adjustOffsetForFixedPosition(rect);
+      transformState.move(rect.x(), rect.y());
+    }
     return;
   }
 
@@ -2164,6 +2172,14 @@ void LayoutObject::mapAncestorToLocal(const LayoutBoxModelObject* ancestor,
   if (ancestorSkipped) {
     containerOffset = ancestor->offsetFromAncestorContainer(o);
     transformState.move(-containerOffset.width(), -containerOffset.height());
+    // If the ancestor is fixed, then the rect is already in its coordinates so
+    // doesn't need viewport-adjusting.
+    if (ancestor->style()->position() != FixedPosition && o->isLayoutView() &&
+        styleRef().position() == FixedPosition) {
+      LayoutRect rect;
+      toLayoutView(o)->adjustOffsetForFixedPosition(rect);
+      transformState.move(rect.x(), rect.y());
+    }
   }
 }