Need to be inside the flow thread before converting a visual point.

third_party/WebKit/Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc.
  *               All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
  *               (http://www.torchmobile.com/)
@@ skipping 2146 matching lines @@
     } else if (container->isBox()) {
       applyContainerFlip = container->style()->isFlippedBlocksWritingMode();
       mode &= ~ApplyContainerFlip;
     }
   }
 
   if (!ancestorSkipped)
     container->mapAncestorToLocal(ancestor, transformState, mode);
 
   LayoutSize containerOffset = offsetFromContainer(container);
-  if (isLayoutFlowThread()) {
-    // Descending into a flow thread. Convert to the local coordinate space,
-    // i.e. flow thread coordinates.
-    LayoutPoint visualPoint = LayoutPoint(transformState.mappedPoint());
-    transformState.move(
-        visualPoint -
-        toLayoutFlowThread(this)->visualPointToFlowThreadPoint(visualPoint));
-  }
-
   bool preserve3D =
       mode & UseTransforms &&
       (container->style()->preserves3D() || style()->preserves3D());
   if (mode & UseTransforms && shouldUseTransformFromContainer(container)) {
     TransformationMatrix t;
     getTransformFromContainer(container, containerOffset, t);
     transformState.applyTransform(t, preserve3D
                                          ? TransformState::AccumulateTransform
                                          : TransformState::FlattenTransform);
   } else {
     transformState.move(containerOffset.width(), containerOffset.height(),
                         preserve3D ? TransformState::AccumulateTransform
                                    : TransformState::FlattenTransform);
   }
 
+  if (isLayoutFlowThread()) {
+    // Descending into a flow thread. Convert to the local coordinate space,
+    // i.e. flow thread coordinates.
+    LayoutPoint visualPoint = LayoutPoint(transformState.mappedPoint());
+    transformState.move(
+        visualPoint -
+        toLayoutFlowThread(this)->visualPointToFlowThreadPoint(visualPoint));
+  }
+
   if (applyContainerFlip) {
     IntPoint centerPoint = roundedIntPoint(transformState.mappedPoint());
     transformState.move(
         centerPoint -
         toLayoutBox(container)->flipForWritingMode(LayoutPoint(centerPoint)));
   }
 
   if (ancestorSkipped) {
     containerOffset = ancestor->offsetFromAncestorContainer(container);
     transformState.move(-containerOffset.width(), -containerOffset.height());
@@ skipping 1318 matching lines @@
     const blink::LayoutObject* root = object1;
     while (root->parent())
       root = root->parent();
     root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
   } else {
     WTFLogAlways("%s", "Cannot showLayoutTree. Root is (nil)");
   }
 }
 
 #endif