Fix invalidation under scroll, and cull rect testing, of flipped-block writing mode elements.

third_party/WebKit/Source/core/paint/BlockPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/BlockPainter.h"
 
 #include "core/editing/DragCaretController.h"
 #include "core/editing/FrameSelection.h"
 #include "core/layout/LayoutFlexibleBox.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 209 matching lines @@
         // of <a>, the anonymous container's visual overflow is empty, but we need to continue
         // painting to output <a>'s PDF URL rect which covers the continuations, as if we included
         // <a>'s PDF URL rect into m_layoutBlock's visual overflow.
         Vector<LayoutRect> rects;
         m_layoutBlock.addElementVisualOverflowRects(rects, LayoutPoint());
         overflowRect = unionRect(rects);
     }
     overflowRect.unite(m_layoutBlock.visualOverflowRect());
 
     if (m_layoutBlock.hasOverflowModel() && m_layoutBlock.usesCompositedScrolling()) {
-        overflowRect.unite(m_layoutBlock.layoutOverflowRect());
-        overflowRect.move(-m_layoutBlock.scrolledContentOffset());
+        LayoutRect layoutOverflowRect = m_layoutBlock.layoutOverflowRect();
+        m_layoutBlock.flipForWritingMode(layoutOverflowRect);
+        layoutOverflowRect.move(-m_layoutBlock.scrolledContentOffset());
+        overflowRect.unite(layoutOverflowRect);
     }
-    m_layoutBlock.flipForWritingMode(overflowRect);
+
     overflowRect.moveBy(adjustedPaintOffset);
     return paintInfo.cullRect().intersectsCullRect(overflowRect);
 }
 
 void BlockPainter::paintContents(const PaintInfo& paintInfo, const LayoutPoint& paintOffset)
 {
     DCHECK(!m_layoutBlock.childrenInline());
     PaintInfo paintInfoForDescendants = paintInfo.forDescendants();
     m_layoutBlock.paintChildren(paintInfoForDescendants, paintOffset);
 }
 
 } // namespace blink