Flip for writing mode exactly along the containing block chain.

third_party/WebKit/Source/core/layout/LayoutBox.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBox.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 6b443a587a2ce3eacddf7d97d75734b7ee46f0d8..7fc355d09d9cc91257408c2eebb52256dbaf869e 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -2043,11 +2043,9 @@ bool LayoutBox::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ances
     bool ancestorSkipped;
     bool filterOrReflectionSkipped;
     LayoutObject* container = this->container(ancestor, &ancestorSkipped, &filterOrReflectionSkipped);
-    LayoutBox* localContainingBlock = containingBlock();
     // Skip table row because cells and rows are in the same coordinate space, except when we're already at the ancestor.
     if (container->isTableRow() && container != ancestor) {
         DCHECK(isTableCell());
-        localContainingBlock = toLayoutBox(container->parent());
         container = container->parent();
     }
     if (!container)
@@ -2067,8 +2065,10 @@ bool LayoutBox::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ances
     LayoutPoint topLeft = rect.location();
     // TODO(wkorman): Look into and document why this conditional is needed.
     // Currently present following logic in PaintLayer::updateLayerPosition.
-    if (!(isInline() && isLayoutInline()))
-        topLeft.moveBy(topLeftLocation(localContainingBlock));
+    if (container->isBox())
+        topLeft.moveBy(topLeftLocation(toLayoutBox(container)));
+    else
+        topLeft.move(locationOffset());
 
     const ComputedStyle& styleToUse = styleRef();
     EPosition position = styleToUse.position();