Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp

 /*
  * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 84 matching lines @@
     updateLogicalWidth(); // Called to get the maximum logical width for the columnSet.
     generateColumnSetIntervalTree();
 }
 
 bool LayoutFlowThread::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ancestor, LayoutRect& rect, VisualRectFlags visualRectFlags) const
 {
     ASSERT(ancestor != this); // A flow thread should never be an invalidation container.
     // |rect| is a layout rectangle, where the block direction coordinate is flipped for writing
     // mode. fragmentsBoundingBox(), on the other hand, works on physical rectangles, so we need to
     // flip the rectangle before and after calling it.
-    flipForWritingMode(rect);
     rect = fragmentsBoundingBox(rect);
-    flipForWritingMode(rect);
     return LayoutBlockFlow::mapToVisualRectInAncestorSpace(ancestor, rect, visualRectFlags);
 }
 
 void LayoutFlowThread::layout()
 {
     m_pageLogicalSizeChanged = m_columnSetsInvalidated && everHadLayout();
     LayoutBlockFlow::layout();
     m_pageLogicalSizeChanged = false;
 }
 
@@ skipping 76 matching lines @@
 
 void LayoutFlowThread::MultiColumnSetSearchAdapter::collectIfNeeded(const MultiColumnSetInterval& interval)
 {
     if (m_result)
         return;
     if (interval.low() <= m_offset && interval.high() > m_offset)
         m_result = interval.data();
 }
 
 } // namespace blink