getClientRects() shouldn't clip against any ancestors.

third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h

Index: third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h
diff --git a/third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h b/third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h
index f3f29ac94984384cd4d23a24916d6910392da5ed..248a84399e402f6f20bcc798418970d96a2db23d 100644
--- a/third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h
+++ b/third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h
@@ -103,7 +103,23 @@ class MultiColumnFragmentainerGroup {
       const LayoutRect& boundingBoxInFlowThread) const;
 
   LayoutRect flowThreadPortionRectAt(unsigned columnIndex) const;
-  LayoutRect flowThreadPortionOverflowRectAt(unsigned columnIndex) const;
+
+  enum ClipRectAxesSelector {
+    // Only limit the clip rectangle in the block direction. Leave inline
+    // position and length at infinity. Certain operations require this. Those
+    // operations would typically ideally want no clipping at all, but in our
+    // implementation we have to clip in the block direction, in order to slice
+    // the flow thread properly into columns.
+    BlockDirectionAxis,
+
+    // Limit the clip rectangle along both axes. This is what to use for
+    // painting and hit testing.
+    BothAxes
+  };
+
+  LayoutRect flowThreadPortionOverflowRectAt(
+      unsigned columnIndex,
+      ClipRectAxesSelector = BothAxes) const;
 
   // Get the first and the last column intersecting the specified block range.
   // Note that |logicalBottomInFlowThread| is an exclusive endpoint.