Chrome Version: ToT
OS: All

What steps will reproduce the problem?
(1) Use HTML <div contenteditable style='writing-mode: vertical-rl'><img width=10px height=20px></div>
(2) Try to put caret at the bottom edge of the image


What is the expected result?

A blinking horizontal caret is painted at the bottom edge of the image

What happens instead?

A blinking horizontal caret is painted in the middle of the image

The root cause is that, LayoutBox::LocalCaretRect() calculates the caret rect on the right edge, and then flips it due to vertical writing mode. It should be calculated on the bottom edge directly.