The problem here is that the table header is a single LayoutObject that is
painted into multiple columns. The fix needs to be to union over all of the
positions its in in all columns.
LayoutFlowThread::mapToVisualRectInAncestorSpace calls fragmentsBoundingBox,
which maps from flow thread and visual coordinates.
This works just fine for regular fragmented boxes, which have contiguous sizes
in flow thread space before being cut into fragmented pieces.
However, a repeating column header is special, since it has one-off code that forces it to
paint at the top of each column, pushing other content down.
It seems we need some special code to handle that.
Comment 1 by wkorman@chromium.org
, Jun 7 2016