Fix wrong box-shadow visual overflow with flipped blocks writing mode

third_party/WebKit/Source/core/layout/LayoutBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 3999 matching lines @@
     }
 
     if (style()->hasBorderImageOutsets()) {
         LayoutRectOutsets borderOutsets = style()->borderImageOutsets();
         top = std::max(top, borderOutsets.top());
         right = std::max(right, borderOutsets.right());
         bottom = std::max(bottom, borderOutsets.bottom());
         left = std::max(left, borderOutsets.left());
     }
 
+    // Box-shadow and border-image-outsets are in physical direction. Flip into block direction.
+    if (UNLIKELY(hasFlippedBlocksWritingMode())) {
+        if (isHorizontalWritingMode())
+            std::swap(top, bottom);
+        else
+            std::swap(left, right);
+    }
+
     if (style()->hasOutline()) {
         Vector<LayoutRect> outlineRects;
         // The result rects are in coordinates of this object's border box.
         addOutlineRects(outlineRects, LayoutPoint(), outlineRectsShouldIncludeBlockVisualOverflow());
         LayoutRect rect = unionRectEvenIfEmpty(outlineRects);
         int outlineOutset = style()->outlineOutsetExtent();
         top = std::max(top, -rect.y() + outlineOutset);
         right = std::max(right, rect.maxX() - size().width() + outlineOutset);
         bottom = std::max(bottom, rect.maxY() - size().height() + outlineOutset);
         left = std::max(left, -rect.x() + outlineOutset);
@@ skipping 673 matching lines @@
 
 void LayoutBox::clearPercentHeightDescendants()
 {
     for (LayoutObject* curr = slowFirstChild(); curr; curr = curr->nextInPreOrder(this)) {
         if (curr->isBox())
             toLayoutBox(curr)->removeFromPercentHeightContainer();
     }
 }
 
 } // namespace blink