Don't un-flip if we're only mapping for one object.

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

Index: third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index 8d861de180ec51d88e1ef70344ac4ed219fff897..1dbf0240e93acd28e0361f5fd0132e132b16efd3 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -414,8 +414,11 @@ static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const
     // TODO(wkorman): The flip below is required because visual rects are
     // currently in "physical coordinates with flipped block-flow direction"
     // (see LayoutBoxModelObject.h) but we need them to be in physical
-    // coordinates.
-    if (object.isBox())
+    // coordinates. When we're mapping within exactly one object we keep the
+    // input rect flipped because we'd just have to re-flip in short order, as
+    // the output of this method must be in the "physical coordinates with
+    // flipped block-flow direction.
+    if (object.isBox() && object != ancestor)
         toLayoutBox(&object)->flipForWritingMode(rect);
 
     if (object.isLayoutView())