Don't un-flip if we're only mapping for one object.

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

Index: third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index b45503a9952551ae29af17e7412f6123ac37fde3..70e5d36cfc8833db9ac4f1a0f415d5337d8f0c5d 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -413,8 +413,11 @@ static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const
     // TODO(wkorman): The flip below is required because visual rects are
     // currently in "physical coordinates with flipped block-flow direction"
     // (see LayoutBoxModelObject.h) but we need them to be in physical
-    // coordinates.
-    if (object.isBox())
+    // coordinates. When we're mapping within exactly one object we keep the
+    // input rect flipped because we'd just have to re-flip in short order, as
+    // the output of this method must be in the "physical coordinates with
+    // flipped block-flow direction.
+    if (object.isBox() && object != ancestor)
         toLayoutBox(&object)->flipForWritingMode(rect);
 
     if (object.isLayoutView())