Flip for writing mode exactly along the containing block chain.

third_party/WebKit/Source/core/layout/LayoutObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index ccef0e4d686fbe0047f7d4cccab686dc226671cd..102bd6a3d8c1cf2dd7939d9e1ba41aabb3400711 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -1576,11 +1576,13 @@ bool LayoutObject::mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* an
     if (LayoutObject* parent = this->parent()) {
         if (parent->isBox()) {
             LayoutBox* parentBox = toLayoutBox(parent);
-            if (!parentBox->mapScrollingContentsRectToBoxSpace(rect, parent == ancestor ? ApplyNonScrollOverflowClip : ApplyOverflowClip, visualRectFlags))
-                return false;
+
             // Never flip for SVG as it handles writing modes itself.
             if (!isSVG())
                 parentBox->flipForWritingMode(rect);
+
+            if (!parentBox->mapScrollingContentsRectToBoxSpace(rect, parent == ancestor ? ApplyNonScrollOverflowClip : ApplyOverflowClip, visualRectFlags))
+                return false;
         }
         return parent->mapToVisualRectInAncestorSpace(ancestor, rect, visualRectFlags);
     }