This is also needed by SPv1 new paint invalidation ( bug 591199 ).

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f0b4bc588c246586ffbb3fedc38444e674996913

commit f0b4bc588c246586ffbb3fedc38444e674996913
Author: trchen <trchen@chromium.org>
Date: Wed Mar 16 05:25:54 2016

[SPv2] Fix paint offset computation for LayoutTableCell in property tree builder

The table cells have a weird quirk. Although their layout container is the row,
are painted by the rows and can be affected by transforms on the row,
their layout location is relative to the table section.
(i.e. with the row's location baked-in)

This CL adjusts table cell's paint offset in property tree builder in the
same way as other layout/paint code does.

BUG= 593525 

Review URL: https://codereview.chromium.org/1805283002

Cr-Commit-Position: refs/heads/master@{#381397}

[modify] https://crrev.com/f0b4bc588c246586ffbb3fedc38444e674996913/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
[modify] https://crrev.com/f0b4bc588c246586ffbb3fedc38444e674996913/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilderTest.cpp

I think this has been fixed.