Don't apply container flip when computing offset to transformed ancestor.

third_party/WebKit/Source/core/layout/LayoutObject.h

Index: third_party/WebKit/Source/core/layout/LayoutObject.h
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.h b/third_party/WebKit/Source/core/layout/LayoutObject.h
index de88310f5786ba342e80b7a2ff454b9945d4e90e..b674515edc4b8e4ed49a5dc13946b42309f001d8 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.h
@@ -93,6 +93,11 @@ enum MarkingBehavior {
 enum MapCoordinatesMode {
     IsFixed = 1 << 0,
     UseTransforms = 1 << 1,
+
+    // When walking up the containing block chain, applies a container flip for the first
+    // element found, if any, for which isFlippedBlocksWritingMode is true. This option should
+    // generally be used when mapping a source rect in a logical space to one in a physical

[Xianzhu, 2016/05/06 22:25:04]

"logical space" is not accurate. It's the third coordinate space ('physical
coordinates with flipped block-flow direction') described in the doc of
LayoutBoxModelObject.

[chrishtr, 2016/05/09 16:47:43]

Done.

+    // destination space.
     ApplyContainerFlip = 1 << 2,
     TraverseDocumentBoundaries = 1 << 3,