Fix Ruby visual rects in flipped blocks writing mode.

third_party/WebKit/Source/core/layout/LayoutBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 2076 matching lines @@
         // include a scale.
         rect = LayoutRect(layer()->transform()->mapRect(enclosingIntRect(rect)));
     }
     LayoutPoint topLeft = rect.location();
     if (container->isBox()) {
         topLeft.moveBy(topLeftLocation(toLayoutBox(container)));
         // If the row is the ancestor, however, add its offset back in. In effect, this passes from the joint <td> / <tr>
         // coordinate space to the parent space, then back to <tr> / <td>.
         if (tableRowContainer)
             topLeft.moveBy(-tableRowContainer->topLeftLocation(toLayoutBox(container)));
+    } else if (container->isRuby()) {
+        // TODO(wkorman): Generalize Ruby specialization and/or document more clearly.
+        // See the accompanying specialization in LayoutInline::mapToVisualRectInAncestorSpace.
+        topLeft.moveBy(topLeftLocation());
     } else {
         topLeft.moveBy(location());
     }
 
     const ComputedStyle& styleToUse = styleRef();
     EPosition position = styleToUse.position();
     if (position == AbsolutePosition && container->isInFlowPositioned() && container->isLayoutInline()) {
         topLeft += toLayoutInline(container)->offsetForInFlowPositionedInline(*this);
     } else if (styleToUse.hasInFlowPosition() && layer()) {
         // Apply the relative position offset when invalidating a rectangle.  The layer
@@ skipping 2845 matching lines @@
         m_rareData->m_snapAreas->remove(&snapArea);
     }
 }
 
 SnapAreaSet* LayoutBox::snapAreas() const
 {
     return m_rareData ? m_rareData->m_snapAreas.get() : nullptr;
 }
 
 } // namespace blink