Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

third_party/WebKit/Source/core/layout/LayoutView.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 430 matching lines @@
         compositor()->fullyInvalidatePaint();
 }
 
 bool LayoutView::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ancestor, LayoutRect& rect, VisualRectFlags visualRectFlags) const
 {
     return mapToVisualRectInAncestorSpace(ancestor, rect, 0, visualRectFlags);
 }
 
 bool LayoutView::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ancestor, LayoutRect& rect, MapCoordinatesFlags mode, VisualRectFlags visualRectFlags) const
 {
-    // Convert the rect into the physical coordinates space of this LayoutView.
-    flipForWritingMode(rect);
-
     if (mode & IsFixed)
         adjustOffsetForFixedPosition(rect);
 
     // Apply our transform if we have one (because of full page zooming).
     if (!ancestor && layer() && layer()->transform())
         rect = layer()->transform()->mapRect(rect);
 
     ASSERT(ancestor);
     if (ancestor == this)
         return true;
@@ skipping 539 matching lines @@
     // of this override. All frame scrolling should be handled by
     // ViewportScrollCallback.
 
     if (!frameView())
         return ScrollResult(false, false, delta.width(), delta.height());
 
     return frameView()->getScrollableArea()->userScroll(granularity, delta);
 }
 
 } // namespace blink