Need to be inside the flow thread before converting a visual point.

third_party/WebKit/Source/core/layout/LayoutObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index 0c01284265ff25a16cce08274ab9fd881c03666b..7e6d1b82393cf2d57d21de1177ea35bd69aca50a 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -2164,15 +2164,6 @@ void LayoutObject::mapAncestorToLocal(const LayoutBoxModelObject* ancestor,
     container->mapAncestorToLocal(ancestor, transformState, mode);
 
   LayoutSize containerOffset = offsetFromContainer(container);
-  if (isLayoutFlowThread()) {
-    // Descending into a flow thread. Convert to the local coordinate space,
-    // i.e. flow thread coordinates.
-    LayoutPoint visualPoint = LayoutPoint(transformState.mappedPoint());
-    transformState.move(
-        visualPoint -
-        toLayoutFlowThread(this)->visualPointToFlowThreadPoint(visualPoint));
-  }
-
   bool preserve3D =
       mode & UseTransforms &&
       (container->style()->preserves3D() || style()->preserves3D());
@@ -2188,6 +2179,15 @@ void LayoutObject::mapAncestorToLocal(const LayoutBoxModelObject* ancestor,
                                    : TransformState::FlattenTransform);
   }
 
+  if (isLayoutFlowThread()) {
+    // Descending into a flow thread. Convert to the local coordinate space,
+    // i.e. flow thread coordinates.
+    LayoutPoint visualPoint = LayoutPoint(transformState.mappedPoint());
+    transformState.move(
+        visualPoint -
+        toLayoutFlowThread(this)->visualPointToFlowThreadPoint(visualPoint));
+  }
+
   if (applyContainerFlip) {
     IntPoint centerPoint = roundedIntPoint(transformState.mappedPoint());
     transformState.move(