Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 371 matching lines @@
         rect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, *m_paintInvalidationContainer);
     }
 
     if (m_paintInvalidationContainer->layer()->groupedMapping())
         PaintLayer::mapRectInPaintInvalidationContainerToBacking(*m_paintInvalidationContainer, rect);
     return rect;
 }
 
 static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
+    // TODO(wkorman): The flip below is required because visual rects are
+    // currently in "physical coordinates with flipped block-flow direction"
+    // (see LayoutBoxModelObject.h) but we need them to be in physical
+    // coordinates.
+    if (object.isBox())
+        toLayoutBox(&object)->flipForWritingMode(rect);
+
     if (object.isLayoutView())
         toLayoutView(object).mapToVisualRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisualRectFlags);
     else
         object.mapToVisualRectInAncestorSpace(&ancestor, rect);
 }
 
 void PaintInvalidationState::mapLocalRectToPaintInvalidationContainer(LayoutRect& rect) const
 {
     ASSERT(!m_didUpdateForChildren);
 
@@ skipping 85 matching lines @@
     WTFLogAlways("Fast path paint invalidation rect differs from slow path: fast: %s vs slow: %s",
         fastPathRect.toString().ascii().data(), slowPathRect.toString().ascii().data());
     showLayoutTree(&m_currentObject);
 
     ASSERT_NOT_REACHED();
 }
 
 #endif // CHECK_FAST_PATH_SLOW_PATH_EQUALITY
 
 } // namespace blink