[geometry] replace m12 with m21 when transform DOMPoint from DOMMatrix.

third_party/WebKit/Source/core/geometry/DOMMatrixReadOnly.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/geometry/DOMMatrixReadOnly.h"
 
 #include "bindings/core/v8/V8ObjectBuilder.h"
 #include "core/css/CSSIdentifierValue.h"
 #include "core/css/CSSToLengthConversionData.h"
 #include "core/css/CSSValueList.h"
@@ skipping 258 matching lines @@
   flip_y->setM24(-this->m24());
   return flip_y;
 }
 
 DOMMatrix* DOMMatrixReadOnly::inverse() {
   return DOMMatrix::Create(this)->invertSelf();
 }
 
 DOMPoint* DOMMatrixReadOnly::transformPoint(const DOMPointInit& point) {
   if (is2D() && point.z() == 0 && point.w() == 1) {
-    double x = point.x() * m11() + point.y() * m12() + m41();
+    double x = point.x() * m11() + point.y() * m21() + m41();
     double y = point.x() * m12() + point.y() * m22() + m42();
     return DOMPoint::Create(x, y, 0, 1);
   }
 
   double x = point.x() * m11() + point.y() * m21() + point.z() * m31() +
              point.w() * m41();
   double y = point.x() * m12() + point.y() * m22() + point.z() * m32() +
              point.w() * m42();
   double z = point.x() * m13() + point.y() * m23() + point.z() * m33() +
              point.w() * m43();
@@ skipping 122 matching lines @@
 
   matrix_->MakeIdentity();
   operations.Apply(FloatSize(0, 0), *matrix_);
 
   is2d_ = !operations.Has3DOperation();
 
   return;
 }
 
 }  // namespace blink