Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

Index: third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index c3076c44fdd9bf6bca105712098a6ecad085288e..265720bf8ba8f59be836c74ea36274b1a54d17f8 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -389,6 +389,9 @@ LayoutRect PaintInvalidationState::computePaintInvalidationRectInBackingForSVG()
 
 static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
+    if (object.isBox())

[chrishtr, 2016/07/09 00:15:57]

Why is this necessary?

[wkorman, 2016/07/09 01:16:08]

Don't we need to flip to respect object's writing mode before passing to
mapToVisualRectInAncestorSpace?

Tests that fail without this are:

fast/box-shadow/shadow-box-resize-writing-mode.html
fast/repaint/window-resize-vertical-writing-mode.html

And the box-shadow one looks visually broken, i.e. repaint rects are incorrect,
without this flip.

[chrishtr, 2016/07/11 17:35:56]

Let's discuss/debug offline. Maybe I'm misunderstanding something.

+        toLayoutBox(&object)->flipForWritingMode(rect);
+
     if (object.isLayoutView())
         toLayoutView(object).mapToVisualRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisualRectFlags);
     else