Fix SVG vertical text layout issues

third_party/WebKit/Source/core/paint/SVGInlineTextBoxPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/SVGInlineTextBoxPainter.h"
 
 #include "core/editing/Editor.h"
 #include "core/editing/markers/DocumentMarkerController.h"
 #include "core/editing/markers/RenderedDocumentMarker.h"
 #include "core/frame/LocalFrame.h"
@@ skipping 33 matching lines @@
 static bool hasShadow(const PaintInfo& paintInfo, const ComputedStyle& style) {
   // Text shadows are disabled when printing. http://crbug.com/258321
   return style.textShadow() && !paintInfo.isPrinting();
 }
 
 FloatRect SVGInlineTextBoxPainter::boundsForDrawingRecorder(
     const PaintInfo& paintInfo,
     const ComputedStyle& style,
     const LayoutPoint& paintOffset,
     bool includeSelectionRect) const {
-  // We compute the paint rect with what looks like the logical values, to match
-  // the computation in SVGInlineTextBox::calculateBoundaries, and the fact that
-  // vertical (etc) layouts are handled by SVGTextLayoutEngine.
-  LayoutRect bounds(LayoutPoint(m_svgInlineTextBox.topLeft() + paintOffset),
-                    LayoutSize(m_svgInlineTextBox.logicalWidth(),
-                               m_svgInlineTextBox.logicalHeight()));
+  LayoutRect bounds(
+      m_svgInlineTextBox.locationIncludingFlipping() + paintOffset,
+      m_svgInlineTextBox.size());
   if (hasShadow(paintInfo, style))
     bounds.expand(style.textShadow()->rectOutsetsIncludingOriginal());
   if (includeSelectionRect) {
     bounds.unite(m_svgInlineTextBox.localSelectionRect(
         m_svgInlineTextBox.start(),
         m_svgInlineTextBox.start() + m_svgInlineTextBox.len()));
   }
   return FloatRect(bounds);
 }
 
@@ skipping 579 matching lines @@
     }
     FloatRect fragmentRect = m_svgInlineTextBox.selectionRectForTextFragment(
         fragment, textMatchInfo.startPosition, textMatchInfo.endPosition,
         style);
     paintInfo.context.setFillColor(color);
     paintInfo.context.fillRect(fragmentRect);
   }
 }
 
 }  // namespace blink