Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp

 /*
  * Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 2281 matching lines @@
         ASSERT(graphicsLayer == m_graphicsLayer.get() || graphicsLayer == m_scrollingContentsLayer.get());
         anchorLayoutObject = m_owningLayer.layoutObject();
         offsetFromAnchorLayoutObject = graphicsLayer->offsetFromLayoutObject();
         adjustForCompositedScrolling(graphicsLayer, offsetFromAnchorLayoutObject);
     }
 
     // Start with the bounds of the graphics layer in the space of the anchor LayoutObject.
     FloatRect graphicsLayerBoundsInObjectSpace(graphicsLayerBounds);
     graphicsLayerBoundsInObjectSpace.move(offsetFromAnchorLayoutObject);
     // The object space means including writing mode flip.
-    if (anchorLayoutObject->isBox())
+    if (anchorLayoutObject->isBox() && !anchorLayoutObject->isLayoutView())

[chrishtr, 2016/07/08 19:54:51]

Why this change?

[wkorman, 2016/07/08 23:55:50]

Good point, it looks like perhaps we can as you suggested delete 2302 - 2303.
The unit test which you added in http://crrev.com/1640363003 still passes as
does long-vertical-text.html from crbug.com/581264. I'm running another try job
to see if other tests are affected.

         toLayoutBox(anchorLayoutObject)->flipForWritingMode(graphicsLayerBoundsInObjectSpace);
 
     // Now map the bounds to its visible content rect in screen space, including applying clips along the way.
     LayoutRect visibleContentRect(graphicsLayerBoundsInObjectSpace);
     LayoutView* rootView = anchorLayoutObject->view();
     while (rootView->frame()->ownerLayoutObject())
         rootView = rootView->frame()->ownerLayoutObject()->view();
     anchorLayoutObject->mapToVisualRectInAncestorSpace(rootView, visibleContentRect);
     visibleContentRect.intersect(LayoutRect(rootView->frameView()->visibleContentRect()));
 
@@ skipping 356 matching lines @@
     } else if (graphicsLayer == m_scrollingContentsLayer.get()) {
         name = "Scrolling Contents Layer";
     } else {
         ASSERT_NOT_REACHED();
     }
 
     return name;
 }
 
 } // namespace blink