Fix wrong box-shadow visual overflow with flipped blocks writing mode

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
 #include "core/layout/LayoutPart.h"
@@ skipping 268 matching lines @@
         rect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, m_paintInvalidationContainer);
     }
 
     if (m_paintInvalidationContainer.layer()->groupedMapping())
         PaintLayer::mapRectInPaintInvalidationContainerToBacking(m_paintInvalidationContainer, rect);
     return rect;
 }
 
 static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
-    // TODO(crbug.com/597965): LayoutBox::mapToVisualRectInAncestorSpace() incorrectly flips a rect
-    // in its own space for writing mode. Here flip to workaround the flip.
-    if (object.isBox() && (toLayoutBox(object).isWritingModeRoot() || (ancestor == object && object.styleRef().isFlippedBlocksWritingMode())))
-        toLayoutBox(object).flipForWritingMode(rect);
-
     if (object.isLayoutView()) {
         toLayoutView(object).mapToVisualRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisualRectFlags);
     } else if (object.isSVGRoot()) {
         // TODO(crbug.com/597813): This is to avoid the extra clip applied in LayoutSVGRoot::mapVisibleRectInAncestorSpace().
         toLayoutSVGRoot(object).LayoutReplaced::mapToVisualRectInAncestorSpace(&ancestor, rect);
     } else {
         object.mapToVisualRectInAncestorSpace(&ancestor, rect);
     }
 }
 
@@ skipping 42 matching lines @@
 
 PaintLayer& PaintInvalidationState::enclosingSelfPaintingLayer(const LayoutObject& layoutObject) const
 {
     if (layoutObject.hasLayer() && toLayoutBoxModelObject(layoutObject).hasSelfPaintingLayer())
         return *toLayoutBoxModelObject(layoutObject).layer();
 
     return m_enclosingSelfPaintingLayer;
 }
 
 } // namespace blink