The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/58ec56bf0cac888dd828f5b90b08627e53dd3427

commit 58ec56bf0cac888dd828f5b90b08627e53dd3427
Author: pdr <pdr@chromium.org>
Date: Wed May 25 22:55:09 2016

Remove inlineBoundingBoxOffset from PaintLayer::updateLayerPosition

This extra variable was only used to obfuscate this code. Unfortunately
discovered this while working on 614257.

BUG= 614257 

Review-Url: https://codereview.chromium.org/2013953002
Cr-Commit-Position: refs/heads/master@{#396024}

[modify] https://crrev.com/58ec56bf0cac888dd828f5b90b08627e53dd3427/third_party/WebKit/Source/core/paint/PaintLayer.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0079320b1c8fdad99ef3cb31b92ef09da6ecd2e0

commit 0079320b1c8fdad99ef3cb31b92ef09da6ecd2e0
Author: pdr <pdr@chromium.org>
Date: Fri May 27 00:06:54 2016

Correctly position abspos content inside relpos inlines [spv2]

This patch fixes a class of bugs where absolutely positioned content
in a relative inline container would be positioned relative to the
origin instead of relative to the inline. This largely mirrors the logic
in PaintLayer::updateLayerPosition which used
LayoutInline::offsetForInFlowPositionedInline to position PaintLayers.

BUG= 614257 

Review-Url: https://codereview.chromium.org/2000423009
Cr-Commit-Position: refs/heads/master@{#396324}

[modify] https://crrev.com/0079320b1c8fdad99ef3cb31b92ef09da6ecd2e0/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/0079320b1c8fdad99ef3cb31b92ef09da6ecd2e0/third_party/WebKit/LayoutTests/VirtualTestSuites
[add] https://crrev.com/0079320b1c8fdad99ef3cb31b92ef09da6ecd2e0/third_party/WebKit/LayoutTests/virtual/spv2/fast/css/README.txt
[modify] https://crrev.com/0079320b1c8fdad99ef3cb31b92ef09da6ecd2e0/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/112a79c17f09f9f1aeb2a38fc9672ff3985c7ba8

commit 112a79c17f09f9f1aeb2a38fc9672ff3985c7ba8
Author: pdr <pdr@chromium.org>
Date: Mon Jun 06 20:18:16 2016

[spv2] Account for flipped writing modes in paint offset

Flipped writing modes cause an object's offset to be flipped relative
to its parent. This patch switches from using locationOffset to
topLeftLocation which includes writing mode handling. This matches
similar logic in PaintLayer::updateLayerPosition. A comment has been
added about removing unnecessary craws back up the tree for calculating
containing blocks.

With this patch, all fast/block/positioning tests pass, modulo our lack
of multicolumn fragment painting.

BUG= 614257 

Review-Url: https://codereview.chromium.org/2031873005
Cr-Commit-Position: refs/heads/master@{#398110}

[modify] https://crrev.com/112a79c17f09f9f1aeb2a38fc9672ff3985c7ba8/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/112a79c17f09f9f1aeb2a38fc9672ff3985c7ba8/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp