Created attachment 52394 [details]
reproduce (for DRT)
WebHTMLView.firstRectForCharacterRange returns NSRect with wrong y value.
To reproduce, run attached file on DRT, that will results following text:
You can see a pump "y:600" on y value at the beginning of the line.
Ignore me; this block is just a place holder to make the test result significant.
This problem is observable only from WebKit API, and not visible from DOM.
The test case uses textInputController.firstRectForCharacterRange() to reveal it.
The expectation for LayoutTest/editing/selection/move-left-right.html is also suffered by this problem,
although its difference is minor issue for that test case.
A problem observable via textInputController.firstRectForCharacterRange() would probably affect inline text input, too.