Bug 1090168 - Improve baseline handling for <canvas> text with vertical writing mode - relanding patches 1 and 2, with crash-fix from bug 1099143 folded in. r=jdaggett