[LayoutNG] Fix AdjustPaintOffsetScope for flipped block (vertical-rl)

BlockPainter::PaintChild() calls LayoutBox::FlipForWritingModeForChild()
which subtracts X() twice, so that child painter can add flipped block
physical offset. Because LayoutNG does not apply flipped block to its
Offset(), this resuts in incorrect paint offsets.

I think ideally paint should be able to handle without flipped block
throughout all painters, but I don't have enough knowledge to switch
to, or to add, such a mode to all painters at this point.

This patch matches NGBoxFragmentPainter's semantics to existing
painters for flipped block physical coordinate.

~120 tests pass, ~10 new failures, but remaining failures indicate
that paint offset needs more fixes. The semantics for floats, abspos,
tables, etc. are not clear yet to me.

Bug: 714962
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_layout_ng;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I35857fff030452dc618a529a5c45169e6fac378b
Reviewed-on: https://chromium-review.googlesource.com/966047
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#543929}

third_party/WebKit/LayoutTests/TestExpectations

@@ -447,8 +447,8 @@ crbug.com/714962 virtual/layout_ng/fast/writing-mode/borders.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/box-shadow-horizontal-tb-tile-edge.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/box-shadow-vertical-lr.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/box-shadow-vertical-rl.html [ Failure ]
-crbug.com/714962 virtual/layout_ng/fast/writing-mode/broken-ideograph-small-caps.html [ Failure ]
-crbug.com/714962 virtual/layout_ng/fast/writing-mode/broken-ideographic-font.html [ Failure ]
+crbug.com/714962 [ Mac ] virtual/layout_ng/fast/writing-mode/broken-ideograph-small-caps.html [ Failure ]
+crbug.com/714962 [ Mac ] virtual/layout_ng/fast/writing-mode/broken-ideographic-font.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/english-lr-text.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/english-rl-text.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/fallback-orientation.html [ Failure ]
@@ -457,7 +457,7 @@ crbug.com/714962 virtual/layout_ng/fast/writing-mode/flipped-blocks-hit-test-lin
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/flipped-blocks-inline-map-local-to-container.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/flipped-blocks-text-map-local-to-container.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/japanese-lr-selection.html [ Failure ]
-crbug.com/714962 virtual/layout_ng/fast/writing-mode/japanese-lr-text.html [ Failure ]
+crbug.com/714962 [ Mac Win ] virtual/layout_ng/fast/writing-mode/japanese-lr-text.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/japanese-rl-selection.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/japanese-rl-text-with-broken-font.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/japanese-rl-text.html [ Failure ]
@@ -472,6 +472,7 @@ crbug.com/714962 virtual/layout_ng/fast/writing-mode/percentage-margins-absolute
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/percentage-margins-absolute.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/table-hit-test.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/table-percent-width-quirk.html [ Failure ]
+crbug.com/714962 virtual/layout_ng/fast/writing-mode/table-vertical-child-width.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/text-combine-compress.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/text-combine-justify.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/text-combine-line-break.html [ Failure ]
@@ -479,7 +480,7 @@ crbug.com/714962 virtual/layout_ng/fast/writing-mode/text-combine-various-fonts.
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/text-orientation-basic.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/vertical-align-table-baseline.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/vertical-baseline-alignment.html [ Failure ]
-crbug.com/714962 virtual/layout_ng/fast/writing-mode/vertical-font-fallback.html [ Failure ]
+crbug.com/714962 [ Mac ] virtual/layout_ng/fast/writing-mode/vertical-font-fallback.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/vertical-lr-replaced-selection.html [ Failure ]
 crbug.com/714962 virtual/layout_ng/fast/writing-mode/vertical-rl-replaced-selection.html [ Failure ]
 

third_party/WebKit/Source/core/paint/AdjustPaintOffsetScope.h

@@ -32,8 +32,19 @@ class AdjustPaintOffsetScope {
     DCHECK(fragment.GetLayoutObject());
     const LayoutBox& box = ToLayoutBox(*fragment.GetLayoutObject());
     if (!RuntimeEnabledFeatures::SlimmingPaintV175Enabled() ||
-        !AdjustPaintOffset(box))
-      adjusted_paint_offset_ = paint_offset + fragment.Offset().ToLayoutPoint();
+        !AdjustPaintOffset(box)) {
+      if (!box.HasFlippedBlocksWritingMode()) {
+        adjusted_paint_offset_ =
+            paint_offset + fragment.Offset().ToLayoutPoint();
+      } else {
+        // fragment.Offset() is in physical coordinate, not a flipped physical
+        // coordinate, but BlockPainter::PaintChild() has already incorporated
+        // flipping and assume child painters accumulate flipped offset.
+        // NGBlockNode::CopyFragmentDataToLayoutBox() already computed flipped
+        // fragment.Offset() and stored to LayoutBox, so use it.
+        adjusted_paint_offset_ = paint_offset + box.Location();
+      }
+    }
   }
 
   const PaintInfo& GetPaintInfo() const {