[SPv175+] Flip mask clip rect for inline object writing mode

Bug: 768691
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I46857805a46a44c9c3a2ce3280d7dbb3e32c0825
Reviewed-on: https://chromium-review.googlesource.com/882454Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531993}

third_party/WebKit/LayoutTests/TestExpectations

@@ -81,7 +81,6 @@ crbug.com/769942 virtual/spv175/paint/invalidation/svg/mask-clip-target-transfor
 crbug.com/769942 virtual/spv175/paint/invalidation/svg/resource-invalidate-on-target-update.svg [ Failure ]
 
 crbug.com/771643 virtual/spv175/compositing/overflow/nested-border-radius-clipping.html [ Failure ]
-crbug.com/768691 virtual/spv175/fast/borders/inline-mask-overlay-image-outset-vertical-rl.html [ Failure ]
 crbug.com/771643 virtual/spv175/fast/multicol/border-radius-clipped-layer.html [ Failure ]
 crbug.com/771643 virtual/spv175/fast/multicol/mixed-opacity-test.html [ Failure ]
 crbug.com/771643 virtual/spv175/fast/multicol/multicol-svg.html [ Failure ]

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

@@ -602,10 +602,10 @@ void FragmentPaintPropertyTreeBuilder::UpdateTransform() {
   }
 }
 
-static bool ComputeMaskParameters(IntRect& mask_clip,
-                                  ColorFilter& mask_color_filter,
-                                  const LayoutObject& object,
-                                  const LayoutPoint& paint_offset) {
+static bool ComputeMaskParameters(const LayoutObject& object,
+                                  const LayoutPoint& paint_offset,
+                                  IntRect& mask_clip,
+                                  ColorFilter& mask_color_filter) {
   DCHECK(object.IsBoxModelObject() || object.IsSVGChild());
   const ComputedStyle& style = object.StyleRef();
 
@@ -621,6 +621,7 @@ static bool ComputeMaskParameters(IntRect& mask_clip,
                             : kColorFilterNone;
     return true;
   }
+
   if (!style.HasMask())
     return false;
 
@@ -637,6 +638,8 @@ static bool ComputeMaskParameters(IntRect& mask_clip,
     // Either way here we are only interested in the bounding box of them.
     DCHECK(object.IsLayoutInline());
     maximum_mask_region = ToLayoutInline(object).LinesBoundingBox();
+    if (object.HasFlippedBlocksWritingMode())
+      object.ContainingBlock()->FlipForWritingMode(maximum_mask_region);
   }
   if (style.HasMaskBoxImageOutsets())
     maximum_mask_region.Expand(style.MaskBoxImageOutsets());
@@ -719,7 +722,7 @@ void FragmentPaintPropertyTreeBuilder::UpdateEffect() {
       IntRect mask_clip;
       ColorFilter mask_color_filter;
       bool has_mask = ComputeMaskParameters(
-          mask_clip, mask_color_filter, object_, context_.current.paint_offset);
+          object_, context_.current.paint_offset, mask_clip, mask_color_filter);
       if (has_mask &&
           // TODO(crbug.com/768691): Remove the following condition after mask
           // clip doesn't fail fast/borders/inline-mask-overlay-image-outset-