Fix treatment of layout overflow rect in ScrollAnchor bounds computation.

third_party/WebKit/Source/core/layout/ScrollAnchorTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ScrollAnchor.h"
 
 #include "core/dom/ClientRect.h"
 #include "core/frame/VisualViewport.h"
 #include "core/layout/LayoutBox.h"
 #include "core/layout/LayoutTestHelper.h"
@@ skipping 557 matching lines @@
   ScrollableArea* viewport = layoutViewport();
 
   scrollLayoutViewport(ScrollOffset(0, 200));
   setHeight(document().getElementById("changer"), 200);
 
   EXPECT_EQ(300, viewport->scrollOffsetInt().height());
   EXPECT_EQ(document().getElementById("bottom")->layoutObject(),
             scrollAnchor(viewport).anchorObject());
 }
 
+// Test that we account for the origin of the layout overflow rect when
+// computing bounds for possible descent.
+TEST_P(ScrollAnchorTest, NegativeLayoutOverflow) {
+  setBodyInnerHTML(
+      "<style>"
+      "    body { height: 1200px; }"
+      "    #header { position: relative; height: 100px; }"
+      "    #evil { position: relative; "
+      "      top: -900px; height: 1000px; width: 100px; }"
+      "    #changer { height: 100px; }"
+      "    #anchor { height: 100px; background-color: green }"
+      "</style>"
+      "<div id='header'>"
+      "    <div id='evil'></div>"
+      "</div>"
+      "<div id='changer'></div>"
+      "<div id='anchor'></div>");
+
+  ScrollableArea* viewport = layoutViewport();
+
+  scrollLayoutViewport(ScrollOffset(0, 250));
+  setHeight(document().getElementById("changer"), 200);
+  EXPECT_EQ(350, viewport->scrollOffsetInt().height());
+}
+
 // Test that we descend into zero-height containers that have floating content.
 TEST_P(ScrollAnchorTest, DescendsIntoContainerWithFloat) {
   setBodyInnerHTML(
       "<style>"
       "    body { height: 1000; }"
       "    #outer { width: 300px; }"
       "    #outer:after { content: ' '; clear:both; display: table; }"
       "    #float {"
       "         float: left; background-color: #ccc;"
       "         height: 500px; width: 100%;"
@@ skipping 526 matching lines @@
 
   scrollLayoutViewport(ScrollOffset(-50, 0));
 
   a->setAttribute(HTMLNames::styleAttr, "width: 200px");
   b->setAttribute(HTMLNames::styleAttr, "height: 150px");
   update();
   EXPECT_EQ(ScrollOffset(-100, 150), viewport->getScrollOffset());
   EXPECT_EQ(c->layoutObject(), scrollAnchor(viewport).anchorObject());
 }
 }