Fix LayoutTableRow::AddOverflowFromCell()

third_party/WebKit/Source/core/layout/LayoutTableRow.cpp

Index: third_party/WebKit/Source/core/layout/LayoutTableRow.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutTableRow.cpp b/third_party/WebKit/Source/core/layout/LayoutTableRow.cpp
index a2b8f5d5a253ddc953d75c7d6270bb10bb158fa0..3fdbf597b1d64c51c255896fbe984f5a2ed0d1be 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableRow.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableRow.cpp
@@ -306,7 +306,7 @@ void LayoutTableRow::AddOverflowFromCell(const LayoutTableCell* cell) {
   // The cell and the row share the section's coordinate system. However
   // the visual overflow should be determined in the coordinate system of
   // the row, that's why we shift it below.
-  cell_visual_overflow_rect.MoveBy(-Location());

[Xianzhu, 2017/05/06 00:12:47]

cell_visual_overflow_rect is in cell's coordinates. To convert to row
coordinates, we should move by the difference of locations of the row and the
cell.

This was changed in
https://codereview.chromium.org/2786463004/diff/120001/third_party/WebKit/Sou...,
but the old version was also incorrect:

 LayoutUnit cellOffsetLogicalTopDifference =
    cell->location().y() - location().y();
 cellVisualOverflowRect.move(LayoutUnit(), cellOffsetLogicalTopDifference);	
 addContentsVisualOverflow(cellVisualOverflowRect);

Actually the above code should adjust by difference of x instead of y. The row
and the cell should have the same y, but different x.

+  cell_visual_overflow_rect.Move(cell->Location() - Location());
   AddContentsVisualOverflow(cell_visual_overflow_rect);
 
   // Table row paints its background behind cells. If the cell spans multiple