Fix invalidation under scroll, and cull rect testing, of flipped-block writing mode elements.

third_party/WebKit/Source/core/layout/LayoutBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 973 matching lines @@
         result.expand(-verticalScrollbarWidth(), 0);
     return result;
 }
 
 bool LayoutBox::mapScrollingContentsRectToBoxSpace(LayoutRect& rect, ApplyOverflowClipFlag applyOverflowClip, VisualRectFlags visualRectFlags) const
 {
     if (!hasOverflowClip())
         return true;
 
     LayoutSize offset = LayoutSize(-scrolledContentOffset());
+    // Flipped-blocks scrolling grows in the opposite direction.
+    if (UNLIKELY(hasFlippedBlocksWritingMode()))
+        offset.setWidth(-offset.width());
     rect.move(offset);
 
     if (applyOverflowClip == ApplyNonScrollOverflowClip && scrollsOverflow())
         return true;
 
     LayoutRect clipRect = overflowClipRect(LayoutPoint());
 
     bool doesIntersect;
     if (visualRectFlags & EdgeInclusive) {
         doesIntersect = rect.inclusiveIntersect(clipRect);
@@ skipping 3922 matching lines @@
         m_rareData->m_snapAreas->remove(&snapArea);
     }
 }
 
 SnapAreaSet* LayoutBox::snapAreas() const
 {
     return m_rareData ? m_rareData->m_snapAreas.get() : nullptr;
 }
 
 } // namespace blink