Fix SVG vertical text layout issues

third_party/WebKit/Source/core/paint/SVGInlineTextBoxPainter.cpp

Index: third_party/WebKit/Source/core/paint/SVGInlineTextBoxPainter.cpp
diff --git a/third_party/WebKit/Source/core/paint/SVGInlineTextBoxPainter.cpp b/third_party/WebKit/Source/core/paint/SVGInlineTextBoxPainter.cpp
index 4fa767d538038a247203a6ddbf96e9cffc067072..1cd243bbd4e8e603a2451833e310d2c956f99fd3 100644
--- a/third_party/WebKit/Source/core/paint/SVGInlineTextBoxPainter.cpp
+++ b/third_party/WebKit/Source/core/paint/SVGInlineTextBoxPainter.cpp
@@ -51,12 +51,9 @@ FloatRect SVGInlineTextBoxPainter::boundsForDrawingRecorder(
     const ComputedStyle& style,
     const LayoutPoint& paintOffset,
     bool includeSelectionRect) const {
-  // We compute the paint rect with what looks like the logical values, to match
-  // the computation in SVGInlineTextBox::calculateBoundaries, and the fact that
-  // vertical (etc) layouts are handled by SVGTextLayoutEngine.
-  LayoutRect bounds(LayoutPoint(m_svgInlineTextBox.topLeft() + paintOffset),
-                    LayoutSize(m_svgInlineTextBox.logicalWidth(),
-                               m_svgInlineTextBox.logicalHeight()));
+  LayoutRect bounds(
+      m_svgInlineTextBox.locationIncludingFlipping() + paintOffset,
+      m_svgInlineTextBox.size());
   if (hasShadow(paintInfo, style))
     bounds.expand(style.textShadow()->rectOutsetsIncludingOriginal());
   if (includeSelectionRect) {