Account for perspective and preserve-3d in mapToVisualRectInAncestorSpace

third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp

Index: third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp b/third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp
index 73ddc3f638235dd5c8828474129934d7ef575f67..65d9abf0ee64e7662d248e3f45c14492e45f62f7 100644
--- a/third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp
@@ -85,15 +85,18 @@ void LayoutFlowThread::validateColumnSets() {
   generateColumnSetIntervalTree();
 }
 
-bool LayoutFlowThread::mapToVisualRectInAncestorSpace(
+bool LayoutFlowThread::mapToVisualRectInAncestorSpaceInternal(
     const LayoutBoxModelObject* ancestor,
-    LayoutRect& rect,
+    TransformState& transformState,
     VisualRectFlags visualRectFlags) const {
   // A flow thread should never be an invalidation container.
   DCHECK(ancestor != this);
+  transformState.flatten();
+  LayoutRect rect(transformState.lastPlanarQuad().boundingBox());
   rect = fragmentsBoundingBox(rect);
-  return LayoutBlockFlow::mapToVisualRectInAncestorSpace(ancestor, rect,
-                                                         visualRectFlags);
+  transformState.setQuad(FloatQuad(FloatRect(rect)));
+  return LayoutBlockFlow::mapToVisualRectInAncestorSpaceInternal(
+      ancestor, transformState, visualRectFlags);
 }
 
 void LayoutFlowThread::layout() {