Don't access DisplayItemClient::VisualRect() for cached display items.

third_party/WebKit/Source/platform/graphics/ContentLayerDelegate.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
@@ skipping 72 matching lines @@
     disabled_mode = GraphicsContext::kFullyDisabled;
 
   // Anything other than PaintDefaultBehavior is for testing. In non-testing
   // scenarios, it is an error to call GraphicsLayer::paint. Actual painting
   // occurs in FrameView::paintTree(); this method merely copies the painted
   // output to the WebDisplayItemList.
   if (painting_control != kPaintDefaultBehavior)
     graphics_layer_->Paint(nullptr, disabled_mode);
 
   paint_controller.GetPaintArtifact().AppendToWebDisplayItemList(
+      graphics_layer_->OffsetFromLayoutObjectWithSubpixelAccumulation(),
       web_display_item_list);
 
   paint_controller.SetDisplayItemConstructionIsDisabled(false);
   paint_controller.SetSubsequenceCachingIsDisabled(false);
 }
 
 size_t ContentLayerDelegate::ApproximateUnsharedMemoryUsage() const {
   return graphics_layer_->GetPaintController().ApproximateUnsharedMemoryUsage();
 }
 
 }  // namespace blink