I thought we handled this in https://codereview.chromium.org/2031873005 by updating the paint offset in deriveBorderBoxFromContainerContext.

The CL handles flipping of box children, but not inline children.

One of the test failing because of this bug is paint/invalidation/selection-rl.html [1]. Paint offsets of the inline objects under the vetical-rl body are incorrect.

[1] run-webkit-tests --additional-driver-flag=--enable-blink-features=slimmingPaintInvalidation paint/invalidation/selection-rl.html

Actually it's not PaintPropertyTreeBuilder's fault, because the paint offset of an inline object is actually the paint offset of its containing block. We need to adjust a rect in flipped coordinates into physical coordinates before applying the paint offset.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b9014646db766be89300d38806c340e4b2772e7a

commit b9014646db766be89300d38806c340e4b2772e7a
Author: wangxianzhu <wangxianzhu@chromium.org>
Date: Wed Sep 28 01:41:42 2016

Correct flip of paint invalidation rect in PaintInvalidator

We need convert from flipped physical coordinates for not only
LayoutBoxes (like PaintInvalidationState does), but also non-box
objects before applying paint offset and geometry mappings.

BUG= 648409 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2368373004
Cr-Commit-Position: refs/heads/master@{#421422}

[modify] https://crrev.com/b9014646db766be89300d38806c340e4b2772e7a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=slimmingPaintInvalidation
[modify] https://crrev.com/b9014646db766be89300d38806c340e4b2772e7a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp