Fix invalidation under scroll, and cull rect testing, of flipped-block writing mode elements.

third_party/WebKit/Source/core/layout/LayoutObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index 08e8b52a9a9d7a83da6c8f29fc0b6e00641f3cca..497bfd6efbb95d8d29151d354c0a4a9212e0410a 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -1385,8 +1385,20 @@ PaintInvalidationReason LayoutObject::invalidatePaintIfNeeded(const PaintInvalid
 
     // Composited scrolling should not be included in the bounds and position tracking, because the graphics layer backing the scroller
     // does not move on scroll.
+    // TODO(chrishtr): can we just avoid adding in the scroll in the first place in LayoutBox::mapScrollingContentsRectToBoxSpace?
     if (compositedScrollsWithRespectTo(paintInvalidationContainer)) {
         LayoutSize inverseOffset(toLayoutBox(&paintInvalidationContainer)->scrolledContentOffset());
+        // Flipped-blocks scrolling grows in the opposite direction.
+        if (UNLIKELY(hasFlippedBlocksWritingMode()))
+            inverseOffset.setWidth(-inverseOffset.width());
+
+        PaintLayerScrollableArea* scrollableArea = paintInvalidationContainer.getScrollableArea();
+        DCHECK(scrollableArea);
+
+        // Adjust for the scroll origin. Flipped-blocks writing mode scrolling starts at a different origin.
+        if (UNLIKELY(hasFlippedBlocksWritingMode()))
+            inverseOffset = inverseOffset + toLayoutSize(LayoutPoint(scrollableArea->scrollOrigin()));

[wkorman, 2016/07/14 23:48:52]

nit: could use += and rm the rhs inverseOffset

[chrishtr, 2016/07/14 23:51:10]

Done.

+
         newLocation.move(inverseOffset);
         newBounds.move(inverseOffset);
     }