[Regression] Selections are incorrectly invalidated

Source/core/rendering/RenderReplaced.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011-2012. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 480 matching lines @@
 }
 
 LayoutRect RenderReplaced::selectionRectForPaintInvalidation(const RenderLayerModelObject* paintInvalidationContainer) const
 {
     ASSERT(!needsLayout());
 
     if (!isSelected())
         return LayoutRect();
 
     LayoutRect rect = localSelectionRect();
-    return localToContainerQuad(FloatRect(rect), paintInvalidationContainer).enclosingBoundingBox();
+    mapRectToPaintInvalidationBacking(paintInvalidationContainer, rect, 0);
+    return rect;
 }
 
 LayoutRect RenderReplaced::localSelectionRect(bool checkWhetherSelected) const
 {
     if (checkWhetherSelected && !isSelected())
         return LayoutRect();
 
     if (!inlineBoxWrapper())
         // We're a block-level replaced element.  Just return our own dimensions.
         return LayoutRect(LayoutPoint(), size());
@@ skipping 50 matching lines @@
         return LayoutRect();
 
     // The selectionRect can project outside of the overflowRect, so take their union
     // for paint invalidation to avoid selection painting glitches.
     LayoutRect r = isSelected() ? localSelectionRect() : visualOverflowRect();
     mapRectToPaintInvalidationBacking(paintInvalidationContainer, r, paintInvalidationState);
     return r;
 }
 
 }