Find it and CL did not provide any possible suspect.
Using code search for file "ayoutObject.cpp" from line #9 suspecting the below change
Review URL: https://codereview.chromium.org/2436283002

wangxianzhu@ - Could you please check if this is caused with respect to your change, if not please help us in reassign the issue to the right owner.

Thanks!

Reduced test case:
<table>
  <tr id="tr">
    <td style="position: fixed"></td>
  </tr>
</table>
<script>
setTimeout(function() {
  tr.style.transform = 'translateX(100px)';
}, 0); 
</script>

Deleted: fuzz-1.html 173 bytes

fuzz-1.html 173 bytes View Download

The following assumption of no transform between an object and its container is incorrect:

  if (skipInfo.ancestorSkipped()) {
    // There can't be a transform between paintInvalidationContainer and
    // ancestorToStopAt, because transforms create containers, so it should be
    // safe to just subtract the delta between the ancestor and
    // ancestorToStopAt.
    adjustmentForSkippedAncestor =
        -ancestorToStopAt->offsetFromAncestorContainer(container);
  }

For example:
- fixed-position under non-block transformed object;
- float under transformed inline.

 Issue 715233  has been merged into this issue.

ClusterFuzz testcase 5893196799541248 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.