Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

third_party/WebKit/Source/core/layout/LayoutObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index c2580420c02f4c091e01ae0b105f340926273b41..5ddfe61166a4b94083524cf0de949eb2af0292a4 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -1573,9 +1573,14 @@ bool LayoutObject::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* an
         return true;

[chrishtr, 2016/07/09 00:15:57]

Adjust the comment above to specify that it's in the parent's coordinate space,
except for container flip.

[wkorman, 2016/07/09 01:16:08]

Done.

 
     if (LayoutObject* parent = this->parent()) {
-        if (parent->isBox() && !toLayoutBox(parent)->mapScrollingContentsRectToBoxSpace(rect, parent == ancestor ? ApplyNonScrollOverflowClip : ApplyOverflowClip, visualRectFlags))
-            return false;
-
+        if (parent->isBox()) {
+            LayoutBox* parentBox = toLayoutBox(parent);
+            if (!parentBox->mapScrollingContentsRectToBoxSpace(rect, parent == ancestor ? ApplyNonScrollOverflowClip : ApplyOverflowClip, visualRectFlags))
+                return false;
+            // Never flip for SVG as it handles writing modes itself.
+            if (!isSVG())
+                parentBox->flipForWritingMode(rect);
+        }
         return parent->mapToVisualRectInAncestorSpace(ancestor, rect, visualRectFlags);
     }
     return true;