Consider transformed container's scroll offset when calculating fixed descendant's offset

Source/core/rendering/RenderLayer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 1363 matching lines @@
 
         if (fixedPositionContainerLayer != ancestorLayer) {
             LayoutPoint fixedContainerCoords;
             layer->convertToLayerCoords(fixedPositionContainerLayer, fixedContainerCoords);
 
             LayoutPoint ancestorCoords;
             ancestorLayer->convertToLayerCoords(fixedPositionContainerLayer, ancestorCoords);
 
             location += (fixedContainerCoords - ancestorCoords);
         } else {
+            // RenderView has been handled in the first top-level 'if' block above.
+            ASSERT(ancestorLayer != renderer->view()->layer());
+            ASSERT(ancestorLayer->hasTransformRelatedProperty());
+
             location += layer->location();
+
+            // The spec (http://dev.w3.org/csswg/css-transforms/#transform-rendering) doesn't say if a
+            // fixed-position element under a scrollable transformed element should scroll. However,
+            // other parts of blink scroll the fixed-position element, and the following keeps the consistency.
+            if (RenderLayerScrollableArea* scrollableArea = ancestorLayer->scrollableArea())
+                location -= LayoutSize(scrollableArea->scrollOffset());
         }
         return ancestorLayer;
     }
 
     RenderLayer* parentLayer;
     if (position == AbsolutePosition) {
         // Do what enclosingPositionedAncestor() does, but check for ancestorLayer along the way.
         parentLayer = layer->parent();
         bool foundAncestorFirst = false;
         while (parentLayer) {
@@ skipping 1505 matching lines @@
     }
 }
 
 void showLayerTree(const blink::RenderObject* renderer)
 {
     if (!renderer)
         return;
     showLayerTree(renderer->enclosingLayer());
 }
 #endif