Index: third_party/WebKit/Source/core/layout/LayoutInline.cpp |
diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.cpp b/third_party/WebKit/Source/core/layout/LayoutInline.cpp |
index fefc3724aafd8d8f7eade6f11417d334acc9a356..29a6199a0057ecc1d3019a1ec3f7931b1849dc94 100644 |
--- a/third_party/WebKit/Source/core/layout/LayoutInline.cpp |
+++ b/third_party/WebKit/Source/core/layout/LayoutInline.cpp |
@@ -1098,9 +1098,12 @@ bool LayoutInline::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* an |
// its controlClipRect will be wrong. For overflow clip we use the values cached by the layer. |
rect.setLocation(topLeft); |
- if (container->isBox() && !toLayoutBox(container)->mapScrollingContentsRectToBoxSpace(rect, container == ancestor ? ApplyNonScrollOverflowClip : ApplyOverflowClip, visualRectFlags)) |
+ LayoutBox* containerBox = container->isBox() ? toLayoutBox(container) : nullptr; |
+ if (containerBox && !containerBox->mapScrollingContentsRectToBoxSpace(rect, container == ancestor ? ApplyNonScrollOverflowClip : ApplyOverflowClip, visualRectFlags)) |
return false; |
+ if (containerBox) |
+ containerBox->flipForWritingMode(rect); |
return container->mapToVisualRectInAncestorSpace(ancestor, rect, visualRectFlags); |
} |