Don't over-flip when mapping visual rects for Ruby text.

third_party/WebKit/Source/core/layout/LayoutInline.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 1078 matching lines @@
     }
 
     // FIXME: We ignore the lightweight clipping rect that controls use, since if |o| is in mid-layout,
     // its controlClipRect will be wrong. For overflow clip we use the values cached by the layer.
     rect.setLocation(topLeft);
 
     LayoutBox* containerBox = container->isBox() ? toLayoutBox(container) : nullptr;
     if (containerBox && !containerBox->mapScrollingContentsRectToBoxSpace(rect, container == ancestor ? ApplyNonScrollOverflowClip : ApplyOverflowClip, visualRectFlags))
         return false;
 
-    if (containerBox)
+    // Ruby text is implemented as an inline block containing the text and
+    // annotations (if any). The rect will already be flipped as necessary by
+    // the containing LayoutRuby{Text,Base} boxes, so we need to make sure we do
+    // not flip again for the LayoutRuby container. See also
+    // https://www.w3.org/TR/css-ruby-1/#ruby-container
+    if (containerBox && !isRuby())
         containerBox->flipForWritingMode(rect);
     return container->mapToVisualRectInAncestorSpace(ancestor, rect, visualRectFlags);
 }
 
 LayoutSize LayoutInline::offsetFromContainer(const LayoutObject* container) const
 {
     ASSERT(container == this->container());
 
     LayoutSize offset;
     if (isInFlowPositioned())
@@ skipping 242 matching lines @@
 
 void LayoutInline::invalidateDisplayItemClients(PaintInvalidationReason invalidationReason) const
 {
     LayoutBoxModelObject::invalidateDisplayItemClients(invalidationReason);
 
     for (InlineFlowBox* box = firstLineBox(); box; box = box->nextLineBox())
         invalidateDisplayItemClient(*box, invalidationReason);
 }
 
 } // namespace blink