position:fixed content is not offset by relative positioned ancestors

third_party/WebKit/Source/core/layout/LayoutBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc.
  *               All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 4148 matching lines @@
     const LayoutBox* child,
     const LayoutBoxModelObject* containerBlock) {
   if (!logicalTop.isAuto() || !logicalBottom.isAuto())
     return;
 
   // FIXME: The static distance computation has not been patched for mixed
   // writing modes.
   LayoutUnit staticLogicalTop = child->layer()->staticBlockPosition();
   for (LayoutObject* curr = child->parent(); curr && curr != containerBlock;
        curr = curr->container()) {
-    if (!curr->isBox() || curr->isTableRow())
+    if (!curr->isBox())
       continue;
     const LayoutBox& box = *toLayoutBox(curr);
-    staticLogicalTop += box.logicalTop();
+    if (!curr->isTableRow())
+      staticLogicalTop += box.logicalTop();

[mstensho (USE GERRIT), 2016/12/16 11:53:00]

The table rows change here doesn't look right. I suggest that you revert this
part. Both table cells and table rows are relative to their containing table
section, so you end up adding the offset twice.

[Anton Obzhirov, 2016/12/16 14:46:31]

Will do, probably I already got an issue with a layout test because of this.

+    if (box.isInFlowPositioned())
+      staticLogicalTop += box.offsetForInFlowPosition().height();
     if (!box.isLayoutFlowThread())
       continue;
     // We're walking out of a flowthread here. This flow thread is not in the
     // containing block chain, so we need to convert the position from the
     // coordinate space of this flowthread to the containing coordinate space.
     // The inline position cannot affect the block position, so we don't bother
     // calculating it.
     LayoutUnit dummyInlinePosition;
     toLayoutFlowThread(box).flowThreadToContainingCoordinateSpace(
         staticLogicalTop, dummyInlinePosition);
@@ skipping 1477 matching lines @@
     block->adjustChildDebugRect(rect);
 
   return rect;
 }
 
 bool LayoutBox::shouldClipOverflow() const {
   return hasOverflowClip() || styleRef().containsPaint() || hasControlClip();
 }
 
 }  // namespace blink