Use viewportConstrainedVisibleContentRect() to get the scrolling offset

Source/core/paint/BoxPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/paint/BoxPainter.h"
 
 #include "core/HTMLNames.h"
 #include "core/frame/Settings.h"
 #include "core/html/HTMLFrameOwnerElement.h"
@@ skipping 681 matching lines @@
         } else {
             positioningAreaSize = pixelSnappedIntSize(paintRect.size() - LayoutSize(left + right, top + bottom), paintRect.location());
         }
     } else {
         geometry.setHasNonLocalGeometry();
 
         IntRect viewportRect = pixelSnappedIntRect(obj.viewRect());
         if (fixedBackgroundPaintsInLocalCoordinates(obj))
             viewportRect.setLocation(IntPoint());
         else if (FrameView* frameView = obj.view()->frameView())
-            viewportRect.setLocation(IntPoint(frameView->scrollOffsetForFixedPosition()));
+            viewportRect.setLocation(IntPoint(frameView->scrollOffsetForViewportConstrainedObjects()));
 
         if (paintContainer) {
             IntPoint absoluteContainerOffset = roundedIntPoint(paintContainer->localToAbsolute(FloatPoint()));
             viewportRect.moveBy(-absoluteContainerOffset);
         }
 
         geometry.setDestRect(pixelSnappedIntRect(viewportRect));
         positioningAreaSize = geometry.destRect().size();
     }
 
@@ skipping 1460 matching lines @@
 
     FloatPoint secondQuad[4];
     secondQuad[0] = quad[0];
     secondQuad[1] = FloatPoint(quad[0].x() - r1 * cx, quad[0].y() - r1 * cy);
     secondQuad[2] = quad[2];
     secondQuad[3] = quad[3];
     graphicsContext->clipPolygon(4, secondQuad, !secondEdgeMatches);
 }
 
 } // namespace blink