Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 371 matching lines @@
         rect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, *m_paintInvalidationContainer);
     }
 
     if (m_paintInvalidationContainer->layer()->groupedMapping())
         PaintLayer::mapRectInPaintInvalidationContainerToBacking(*m_paintInvalidationContainer, rect);
     return rect;
 }
 
 static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
+    if (object.isBox())

[chrishtr, 2016/07/09 00:15:57]

Why is this necessary?

[wkorman, 2016/07/09 01:16:08]

Don't we need to flip to respect object's writing mode before passing to
mapToVisualRectInAncestorSpace?

Tests that fail without this are:

fast/box-shadow/shadow-box-resize-writing-mode.html
fast/repaint/window-resize-vertical-writing-mode.html

And the box-shadow one looks visually broken, i.e. repaint rects are incorrect,
without this flip.

[chrishtr, 2016/07/11 17:35:56]

Let's discuss/debug offline. Maybe I'm misunderstanding something.

+        toLayoutBox(&object)->flipForWritingMode(rect);
+
     if (object.isLayoutView())
         toLayoutView(object).mapToVisualRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisualRectFlags);
     else
         object.mapToVisualRectInAncestorSpace(&ancestor, rect);
 }
 
 void PaintInvalidationState::mapLocalRectToPaintInvalidationContainer(LayoutRect& rect) const
 {
     ASSERT(!m_didUpdateForChildren);
 
@@ skipping 85 matching lines @@
     WTFLogAlways("Fast path paint invalidation rect differs from slow path: fast: %s vs slow: %s",
         fastPathRect.toString().ascii().data(), slowPathRect.toString().ascii().data());
     showLayoutTree(&m_currentObject);
 
     ASSERT_NOT_REACHED();
 }
 
 #endif // CHECK_FAST_PATH_SLOW_PATH_EQUALITY
 
 } // namespace blink