Fix CSS outline property in flipped blocks Writing Mode (vertical-rl)

third_party/WebKit/Source/core/paint/ObjectPainter.cpp

Index: third_party/WebKit/Source/core/paint/ObjectPainter.cpp
diff --git a/third_party/WebKit/Source/core/paint/ObjectPainter.cpp b/third_party/WebKit/Source/core/paint/ObjectPainter.cpp
index b82157054ef57ac539465b8fc80f62d18c6187c6..987f6806f4c3d7ee848cc3fcbfca6b8082752404 100644
--- a/third_party/WebKit/Source/core/paint/ObjectPainter.cpp
+++ b/third_party/WebKit/Source/core/paint/ObjectPainter.cpp
@@ -5,6 +5,7 @@
 #include "config.h"
 #include "core/paint/ObjectPainter.h"
 
+#include "core/layout/LayoutBlock.h"
 #include "core/layout/LayoutInline.h"
 #include "core/layout/LayoutObject.h"
 #include "core/layout/LayoutTheme.h"
@@ -206,6 +207,14 @@ void ObjectPainter::paintOutline(const PaintInfo& paintInfo, const LayoutPoint&
     if (LayoutObjectDrawingRecorder::useCachedDrawingIfPossible(*paintInfo.context, m_layoutObject, paintInfo.phase, paintOffset))
         return;
 
+    // The result rects are in coordinates of m_layoutObject's border box.
+    // Block flipping is not applied yet if !m_layoutObject.isBox().
+    if (!m_layoutObject.isBox() && m_layoutObject.styleRef().isFlippedBlocksWritingMode()) {
+        LayoutBlock* container = m_layoutObject.containingBlock();
+        if (container)
+            m_layoutObject.localToContainerRects(outlineRects, container, -paintOffset, paintOffset);
+    }
+
     Vector<IntRect> pixelSnappedOutlineRects;
     for (auto& r : outlineRects)
         pixelSnappedOutlineRects.append(pixelSnappedIntRect(r));