Consider transformed container's scroll offset when calculating fixed descendant's offset

Source/core/rendering/RenderLayer.cpp

Index: Source/core/rendering/RenderLayer.cpp
diff --git a/Source/core/rendering/RenderLayer.cpp b/Source/core/rendering/RenderLayer.cpp
index 350a96c44547cbcc058aa4e77a3511d97f2b72cb..7e1cd71facf5ec6a78405feea570ed77542d90e5 100644
--- a/Source/core/rendering/RenderLayer.cpp
+++ b/Source/core/rendering/RenderLayer.cpp
@@ -1381,7 +1381,17 @@ static inline const RenderLayer* accumulateOffsetTowardsAncestor(const RenderLay
 
             location += (fixedContainerCoords - ancestorCoords);
         } else {
+            // RenderView has been handled in the first top-level 'if' block above.
+            ASSERT(ancestorLayer != renderer->view()->layer());
+            ASSERT(ancestorLayer->hasTransformRelatedProperty());
+
             location += layer->location();
+
+            // The spec (http://dev.w3.org/csswg/css-transforms/#transform-rendering) doesn't say if a
+            // fixed-position element under a scrollable transformed element should scroll. However,
+            // other parts of blink scroll the fixed-position element, and the following keeps the consistency.
+            if (RenderLayerScrollableArea* scrollableArea = ancestorLayer->scrollableArea())
+                location -= LayoutSize(scrollableArea->scrollOffset());
         }
         return ancestorLayer;
     }