Fix invalidation under scroll, and cull rect testing, of flipped-block writing mode elements.

third_party/WebKit/Source/core/paint/BlockPainter.cpp

Index: third_party/WebKit/Source/core/paint/BlockPainter.cpp
diff --git a/third_party/WebKit/Source/core/paint/BlockPainter.cpp b/third_party/WebKit/Source/core/paint/BlockPainter.cpp
index ae250bfccabca4a2900c7f12483378e5d69586fd..6bea9d3d4d49de5a249dfcb9d09a50bbe4c5875c 100644
--- a/third_party/WebKit/Source/core/paint/BlockPainter.cpp
+++ b/third_party/WebKit/Source/core/paint/BlockPainter.cpp
@@ -226,11 +226,19 @@ bool BlockPainter::intersectsPaintRect(const PaintInfo& paintInfo, const LayoutP
     }
     overflowRect.unite(m_layoutBlock.visualOverflowRect());
 
-    if (m_layoutBlock.hasOverflowModel() && m_layoutBlock.usesCompositedScrolling()) {
-        overflowRect.unite(m_layoutBlock.layoutOverflowRect());
-        overflowRect.move(-m_layoutBlock.scrolledContentOffset());
+    bool usesCompositedScrolling = m_layoutBlock.hasOverflowModel() && m_layoutBlock.usesCompositedScrolling();
+
+    if (usesCompositedScrolling) {
+        LayoutRect layoutOverflowRect = m_layoutBlock.layoutOverflowRect();
+        overflowRect.unite(layoutOverflowRect);
     }
     m_layoutBlock.flipForWritingMode(overflowRect);
+
+    // Scrolling is applied in physical space, which is why it is after the flip above.
+    if (usesCompositedScrolling) {
+        overflowRect.move(-m_layoutBlock.scrolledContentOffset());
+    }
+
     overflowRect.moveBy(adjustedPaintOffset);
     return paintInfo.cullRect().intersectsCullRect(overflowRect);
 }