[S.P.] Fix cull rects for InlineTextBox to account for vertical text.

Source/core/layout/line/InlineBox.cpp

Index: Source/core/layout/line/InlineBox.cpp
diff --git a/Source/core/layout/line/InlineBox.cpp b/Source/core/layout/line/InlineBox.cpp
index 2bde2572778d3b82723a00be7ef45ad36cf0e120..fc22b510276a78170137e85782091048f8d54d46 100644
--- a/Source/core/layout/line/InlineBox.cpp
+++ b/Source/core/layout/line/InlineBox.cpp
@@ -310,14 +310,29 @@ void InlineBox::clearKnownToHaveNoOverflow()
 
 FloatPointWillBeLayoutPoint InlineBox::locationIncludingFlipping()
 {
+    return logicalPointToPhysicalPoint(m_topLeft.toFloatPoint());
+}
+
+FloatPointWillBeLayoutPoint InlineBox::logicalPointToPhysicalPoint(const FloatPoint& point)
+{
     if (!UNLIKELY(layoutObject().hasFlippedBlocksWritingMode()))
-        return FloatPointWillBeLayoutPoint(x(), y());
+        return FloatPointWillBeLayoutPoint(point.x(), point.y());
 
     LayoutBlockFlow& block = root().block();
     if (block.style()->isHorizontalWritingMode())
-        return FloatPointWillBeLayoutPoint(x(), block.size().height() - size().height() - y());
+        return FloatPointWillBeLayoutPoint(point.x(), block.size().height() - size().height() - point.y());
 
-    return FloatPointWillBeLayoutPoint(block.size().width() - size().width() - x(), y());
+    return FloatPointWillBeLayoutPoint(block.size().width() - size().width() - point.x(), point.y());
+}
+
+LayoutRect InlineBox::logicalRectToPhysicalRect(const LayoutRect& current)
+{
+    LayoutRect retval = current;
+    if (!isHorizontal()) {
+        retval = retval.transposedRect();
+    }
+    retval.setLocation(logicalPointToPhysicalPoint(FloatPoint(retval.location())).toLayoutPoint());
+    return retval;
 }
 
 void InlineBox::flipForWritingMode(FloatRect& rect)