[LayoutNG] Fix coordinate of VisualOverflowRect and OverflowClipRect

This patch fixes the coordinate system of VisualOverflowRect and
OverflowClipRect to be relative to the object itself.

VisualRect() is relative to the object that owns the GraphicsLayer
(in SPv1) or to the parent transform node (in SPv2), and that
returning VisualRect() caused objects at lower half of the screen
being not painted.

Bug: 714962
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I2abd948598232b9dd660848f67006b5fb71a594c
Reviewed-on: https://chromium-review.googlesource.com/760716
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#515524}

third_party/WebKit/Source/core/paint/ng/ng_paint_fragment.h

@@ -56,10 +56,12 @@ class NGPaintFragment : public DisplayItemClient, public ImageResourceObserver {
   bool ShouldClipOverflow() const { return false; }
   bool HasSelfPaintingLayer() const { return false; }
   LayoutRect VisualRect() const override { return visual_rect_; }
-  LayoutRect VisualOverflowRect() const { return VisualRect(); }
-  LayoutRect OverflowClipRect(const LayoutPoint&,
+  LayoutRect VisualOverflowRect() const {
+    return {LayoutPoint(), VisualRect().Size()};
+  }
+  LayoutRect OverflowClipRect(const LayoutPoint& location,
                               OverlayScrollbarClipBehavior) const {
-    return VisualRect();
+    return {location, VisualRect().Size()};
   }
 
   // DisplayItemClient methods.