getClientRects() shouldn't clip against any ancestors.

third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp

Index: third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp b/third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp
index 3d5310931846e5443c88bdd45413c4d0896a43ca..61bf57342b747e37f89529154dceaeed0e3007cd 100644
--- a/third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp
@@ -139,7 +139,9 @@ void LayoutFlowThread::absoluteQuadsForDescendant(const LayoutBox& descendant,
     LayoutRect fragment = boundingRectInFlowThread;
     // We use inclusiveIntersect() because intersect() would reset the
     // coordinates for zero-height objects.
-    fragment.inclusiveIntersect(iterator.fragmentainerInFlowThread());
+    LayoutRect clipRect = iterator.clipRectInFlowThread(
+        MultiColumnFragmentainerGroup::BlockDirectionAxis);
+    fragment.inclusiveIntersect(clipRect);
     fragment.moveBy(-offsetFromFlowThread);
     quads.push_back(descendant.localToAbsoluteQuad(FloatRect(fragment), mode));
   }