Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

third_party/WebKit/Source/core/layout/LayoutBox.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2006, 2007 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 855 matching lines @@
         if (!UNLIKELY(hasFlippedBlocksWritingMode()))
             return position;
         return FloatPoint(m_frameRect.width() - position.x(), position.y());
     }
     void flipForWritingMode(FloatRect& rect) const
     {
         if (!UNLIKELY(hasFlippedBlocksWritingMode()))
             return;
         rect.setX(m_frameRect.width() - rect.maxX());
     }
-    // These represent your location relative to your container as a physical offset.
-    // In layout related methods you almost always want the logical location (e.g. x() and y()).
-    LayoutPoint topLeftLocation() const;
+    // These represent your location relative to your container as a physical
+    // offset. In layout related methods you almost always want the logical
+    // location (e.g. x() and y()). Passing |container| causes flipped-block
+    // flipping w.r.t. that container, or containingBlock() otherwise.
+    LayoutPoint topLeftLocation(const LayoutBox* flippedBlocksContainer = nullptr) const;
     LayoutSize topLeftLocationOffset() const { return toLayoutSize(topLeftLocation()); }
 
     LayoutRect logicalVisualOverflowRectForPropagation(const ComputedStyle&) const;
     LayoutRect visualOverflowRectForPropagation(const ComputedStyle&) const;
     LayoutRect logicalLayoutOverflowRectForPropagation(const ComputedStyle&) const;
     LayoutRect layoutOverflowRectForPropagation(const ComputedStyle&) const;
 
     bool hasOverflowModel() const { return m_overflow.get(); }
     bool hasSelfVisualOverflow() const { return m_overflow && !borderBoxRect().contains(m_overflow->selfVisualOverflowRect()); }
     bool hasVisualOverflow() const { return m_overflow && !borderBoxRect().contains(visualOverflowRect()); }
@@ skipping 341 matching lines @@
         || breakValue == BreakLeft
         || breakValue == BreakPage
         || breakValue == BreakRecto
         || breakValue == BreakRight
         || breakValue == BreakVerso;
 }
 
 } // namespace blink
 
 #endif // LayoutBox_h