See the attached test case. Looks like the offset within the containing block is being added twice.
Created attachment 14509 [details] Test case
Created attachment 14510 [details] Pass off the rect in local coordinates to computeAbsoluteRepaintRect()
Comment on attachment 14510 [details] Pass off the rect in local coordinates to computeAbsoluteRepaintRect() RenderListMarker probably needs the same fix, so I'll try to add that.
Created attachment 14512 [details] Pass off the rect in local coordinates to computeAbsoluteRepaintRect() Also fixes the list marker regression, which was detected by an existing pixel test!
Comment on attachment 14512 [details] Pass off the rect in local coordinates to computeAbsoluteRepaintRect() r=me
Actually, the image bug was also covered by a pixel test, fast/overflow/image-selection-highlight.html but it's good to have the new test for the no-overflow case too.
Landed in r21436.