Created attachment 112999 [details] testcase In the test case you should se only a blue box.
Same thing happens with horizontal-bt.
I think InlineFlowBox::flipLinesInBlockDirection might be doing the wrong thing...but I'm not totally clear on how to fix it.
Created attachment 113010 [details] Patch
Comment on attachment 113010 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=113010&action=review Not totally convinced this patch is correct, but I think it's roughly heading in the right direction and the tests pass. :) > Source/WebCore/rendering/InlineFlowBox.cpp:703 > + LayoutUnit oldTop = logicalTop(); > if (renderer()->style()->isFlippedLinesWritingMode()) > - flipLinesInBlockDirection(lineTopIncludingMargins, lineBottomIncludingMargins); > + flipLinesInBlockDirection(lineTopIncludingMargins, max(lineBottom, lineBottomIncludingMargins)); I'm not 100% sure it makes sense to move this above the if-statement below, but we need this lineBottom for the child linebox in flipLinesInBlockDirection. > Source/WebCore/rendering/InlineFlowBox.cpp:726 > + LayoutUnit currBottom = max(lineBottom, curr->logicalTop() + curr->logicalHeight()); > + curr->setLogicalTop(currBottom - (curr->logicalTop() - lineTop) - curr->logicalHeight()); This is the part that actually fixes the bug.
Comment on attachment 113010 [details] Patch Attachment 113010 [details] did not pass chromium-ews (chromium-xvfb): Output: http://queues.webkit.org/results/10242663 New failing tests: fast/block/positioning/vertical-lr/002.html
Comment on attachment 113010 [details] Patch Removing from the review queue as I won't be around to commit this.
This is now fixed in r290229.