Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

third_party/WebKit/Source/core/layout/LayoutTableCell.h

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 283 matching lines @@
 
     void updateLogicalWidth() override;
 
     void paintBoxDecorationBackground(const PaintInfo&, const LayoutPoint&) const override;
     void paintMask(const PaintInfo&, const LayoutPoint&) const override;
 
     bool boxShadowShouldBeAppliedToBackground(BackgroundBleedAvoidance, const InlineFlowBox*) const override;
 
     LayoutSize offsetFromContainer(const LayoutObject*) const override;
     LayoutRect localOverflowRectForPaintInvalidation() const override;
-    bool mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ancestor, LayoutRect&, VisualRectFlags = DefaultVisualRectFlags) const override;
 
     int borderHalfLeft(bool outer) const;
     int borderHalfRight(bool outer) const;
     int borderHalfTop(bool outer) const;
     int borderHalfBottom(bool outer) const;
 
     int borderHalfStart(bool outer) const;
     int borderHalfEnd(bool outer) const;
     int borderHalfBefore(bool outer) const;
     int borderHalfAfter(bool outer) const;
@@ skipping 73 matching lines @@
 }
 
 inline LayoutTableCell* LayoutTableRow::lastCell() const
 {
     return toLayoutTableCell(lastChild());
 }
 
 } // namespace blink
 
 #endif // LayoutTableCell_h