fast/box-shadow/shadow-box-resize-writing-mode.html

<div style="-webkit-writing-mode: vertical-rl"></div>

If forced to go through slow-path paint invalidation rect mapping, the div will invalidate its own rect incorrectly flipped.

Now we flip for writing mode in mapToVisibleRectForPaintInvalidation() for own rect. I think this is similar to scroll offset and clipping that should be applied on child rects only, so we should do the flipping in child's mapToVisibleRectForPaintInvalidation().