Incomplete repaint of input elements in writing-mode overflow

This is a merge of http://trac.webkit.org/changeset/151761 by me.

We calculate repaint rect using unflipped rect. However,
RenderBox::applyCachedClipAndScrollOffsetForRepaint() which is called
from repaint rect calculation wants that its argument rect is
flipped. The reason is:
- paintRect.move(-scrolledContentOffset()); cannot scroll if the rect is
  unflipped.
- It cannot clip using intersect.
Passing unflipped rect to applyCachedClipAndScrollOffsetForRepaint()
cause invalid clipping. Therefore, this patch flipped the rect at the
first part of the function and unflipped it at the last part of the
function.

Scroll bar rect is absolute rect, so it is flipped
rect. RenderLayerScrollableArea::invalidateScrollbarRect() pass the rect
to repaintRectangle() which expects an argument rect is unflipped. This
cause part of overlapping scroll bar doesn't fade out. Therefore, this
patch flipped the rect and pass it to repaintRectangle().

BUG=336715

Review URL: https://codereview.chromium.org/144763002

git-svn-id: svn://svn.chromium.org/blink/trunk@165681 bbb929c8-8fbe-4397-9dbb-9b2b20218538