Don't un-flip if we're only mapping for one object.

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

Index: third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index 8d861de180ec51d88e1ef70344ac4ed219fff897..6407badeab58666337be1fa10c202693dc2bf768 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -414,8 +414,10 @@ static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const
     // TODO(wkorman): The flip below is required because visual rects are
     // currently in "physical coordinates with flipped block-flow direction"
     // (see LayoutBoxModelObject.h) but we need them to be in physical
-    // coordinates.
-    if (object.isBox())
+    // coordinates. When we're mapping within exactly one object we keep the
+    // input rect flipped because we'd just have to re-flip in short order to
+    // produce the final result.

[chrishtr, 2016/09/07 22:47:23]

"because the output of this method must be in the "physical coordinates with
flipped block-flow direction" also

An even simpler way to write this patch could be:

if (object == ancestor)
  return;

[wkorman, 2016/09/07 22:52:28]

Conceptually yes (and I think we'd need an isBox() check?), but there is a small
bit of add'l logic we'd be skipping:

LayoutView::mapToVisualRectInAncestorSpace:
- adjust offset for fixed position (applies scroll/scrolledContent offset, I
think this would apply in some cases)
- apply transform for full page zooming (but only if !ancestor which isn't the
case)

LayoutBox::mapToVisualRectInAncestorSpace:
- inflate for reflection and filter (I think this would apply in some cases)

[chrishtr, 2016/09/07 22:54:02]

Right ok. Makes sense, these are indeed important.

[wkorman, 2016/09/07 23:18:18]

Updated comment.

+    if (object.isBox() && object != ancestor)
         toLayoutBox(&object)->flipForWritingMode(rect);
 
     if (object.isLayoutView())