Rework mapToVisualRectInAncestorSpace to handle flipped blocks correctly.

In particular, we were incorrectly calculating rects for out-of-flow
positioned elements.

Follows canonical logic in PaintLayer::updateLayerPosition().

BUG=616600

Review-Url: https://codereview.chromium.org/2073563002
Cr-Commit-Position: refs/heads/master@{#404925}
12 files changed