Don't over-flip when mapping visual rects for Ruby text.

third_party/WebKit/Source/core/layout/LayoutInline.cpp

Index: third_party/WebKit/Source/core/layout/LayoutInline.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.cpp b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
index 71782d3e40ceebd5141612c58f2a19d3739b6da5..0a387d427d716c6b63acfbc4669905ebd674f617 100644
--- a/third_party/WebKit/Source/core/layout/LayoutInline.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
@@ -1096,7 +1096,12 @@ bool LayoutInline::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* an
     if (containerBox && !containerBox->mapScrollingContentsRectToBoxSpace(rect, container == ancestor ? ApplyNonScrollOverflowClip : ApplyOverflowClip, visualRectFlags))
         return false;
 
-    if (containerBox)
+    // Ruby text is implemented as an inline block containing the text and
+    // annotations (if any). The rect will already be flipped as necessary by
+    // the containing LayoutRuby{Text,Base} boxes, so we need to make sure we do
+    // not flip again for the LayoutRuby container. See also
+    // https://www.w3.org/TR/css-ruby-1/#ruby-container
+    if (containerBox && !isRuby())
         containerBox->flipForWritingMode(rect);
     return container->mapToVisualRectInAncestorSpace(ancestor, rect, visualRectFlags);
 }