LayoutTableCell::OffsetFromContainer() should use the flipped offset of its parent.

third_party/WebKit/Source/core/layout/LayoutTableCell.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc.
  *               All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 383 matching lines @@
   SetOverrideLogicalContentHeight(
       (row_height - CollapsedBorderAndCSSPaddingLogicalHeight())
           .ClampNegativeToZero());
 }
 
 LayoutSize LayoutTableCell::OffsetFromContainer(const LayoutObject* o) const {
   DCHECK_EQ(o, Container());
 
   LayoutSize offset = LayoutBlockFlow::OffsetFromContainer(o);
   if (Parent())
-    offset -= ParentBox()->LocationOffset();
+    offset -= ParentBox()->PhysicalLocationOffset();
 
   return offset;
 }
 
 LayoutRect LayoutTableCell::LocalVisualRect() const {
   // If the table grid is dirty, we cannot get reliable information about
   // adjoining cells, so we ignore outside borders. This should not be a problem
   // because it means that the table is going to recalculate the grid, relayout
   // and issue a paint invalidation of its current rect, which includes any
   // outside borders of this cell.
@@ skipping 1067 matching lines @@
 }
 
 bool LayoutTableCell::HasLineIfEmpty() const {
   if (GetNode() && HasEditableStyle(*GetNode()))
     return true;
 
   return LayoutBlock::HasLineIfEmpty();
 }
 
 }  // namespace blink