Use property tree paint offset when snapping scrolling contents rect

This patch fixes a crash where we were using the wrong paint offset
when snapping the scrolling contents rect. Previously, the scrollable
area's location was used as the paint offset, but this is incorrect
and the property tree builder's context should be used instead.

This patch adds a unit test that mirrors a composited layer mapping
test of the same issue (ScrollLayerSizingSubpixelAccumulation). It
also adds a minimized layout test of the crash.

Bug: 868613

Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I2d045ae4d50ccb7a8eae6efbe2817e6e93d462ee
Reviewed-on: https://chromium-review.googlesource.com/1158798
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Commit-Queue: Philip Rogers <pdr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#580327}
7 files changed