Fix sticky bottom is not applied with both sticky position

third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
index 33672ccc2d653469824876d32a0794e44c97fdf4..8edf6b0ee0477bdcbc76cdd29c61fdb6e0684476 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
@@ -1002,8 +1002,7 @@ void LayoutBoxModelObject::updateStickyPositionConstraints() const {
   if (!style()->left().isAuto() && !style()->right().isAuto()) {
     if (horizontalOffsets >
             scrollContainerRelativeContainingBlockRect.width() ||
-        horizontalOffsets + scrollContainerRelativeContainingBlockRect.width() >
-            constrainingSize.width()) {
+        horizontalOffsets + stickyBoxRect.width() > constrainingSize.width()) {
       skipRight = style()->isLeftToRightDirection();
       skipLeft = !skipRight;
     }
@@ -1034,8 +1033,7 @@ void LayoutBoxModelObject::updateStickyPositionConstraints() const {
                             LayoutUnit(constrainingSize.height()));
   if (!style()->top().isAuto() && !style()->bottom().isAuto()) {
     if (verticalOffsets > scrollContainerRelativeContainingBlockRect.height() ||
-        verticalOffsets + scrollContainerRelativeContainingBlockRect.height() >
-            constrainingSize.height()) {
+        verticalOffsets + stickyBoxRect.height() > constrainingSize.height()) {
       skipBottom = true;
     }
   }