[S.P.] Fix cull rects for InlineTextBox to account for vertical text.

Source/core/layout/line/InlineBox.h

 /*
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 271 matching lines @@
 
     // Use with caution! The type is not checked!
     LayoutBoxModelObject* boxModelObject() const
     {
         if (!layoutObject().isText())
             return toLayoutBoxModelObject(&layoutObject());
         return 0;
     }
 
     FloatPointWillBeLayoutPoint locationIncludingFlipping();
+
+    // Converts from a rect in the logical space of the InlineBox to one in the physical space
+    // of the containing block. The logical space of an InlineBox may be transposed for vertical text and
+    // flipped for right-to-left text.
+    LayoutRect logicalRectToPhysicalRect(const LayoutRect&);
+
     void flipForWritingMode(FloatRect&);
     FloatPoint flipForWritingMode(const FloatPoint&);
     void flipForWritingMode(LayoutRect&);
     LayoutPoint flipForWritingMode(const LayoutPoint&);
 
     bool knownToHaveNoOverflow() const { return m_bitfields.knownToHaveNoOverflow(); }
     void clearKnownToHaveNoOverflow();
 
     bool dirOverride() const { return m_bitfields.dirOverride(); }
     void setDirOverride(bool dirOverride) { m_bitfields.setDirOverride(dirOverride); }
@@ skipping 72 matching lines @@
     private:
         unsigned m_expansion : 12; // for justified text
 
     public:
         signed expansion() const { return m_expansion; }
         void setExpansion(signed expansion) { m_expansion = expansion; }
     };
 #undef ADD_BOOLEAN_BITFIELD
 
 private:
+    // Converts the given point from the logical space of the InlineBox to the physical space of the
+    // containing block.
+    FloatPointWillBeLayoutPoint logicalPointToPhysicalPoint(const FloatPoint&);
+
     InlineBox* m_next; // The next element on the same line as us.
     InlineBox* m_prev; // The previous element on the same line as us.
 
     InlineFlowBox* m_parent; // The box that contains us.
     LayoutObject& m_renderer;
 
 protected:
     // For RootInlineBox
     bool endsWithBreak() const { return m_bitfields.endsWithBreak(); }
     void setEndsWithBreak(bool endsWithBreak) { m_bitfields.setEndsWithBreak(endsWithBreak); }
@@ skipping 45 matching lines @@
 
 } // namespace blink
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 void showTree(const blink::InlineBox*);
 void showLineTree(const blink::InlineBox*);
 #endif
 
 #endif // InlineBox_h