CGDisplayList image buffer contents are upside-down

https://bugs.webkit.org/show_bug.cgi?id=250717
rdar://104102164

Reviewed by Dean Jackson.

* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
(WebKit::RemoteLayerBackingStore::paintContents):
Flip the contents when required.

Canonical link: https://commits.webkit.org/258997@main

Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm

@@ -428,7 +428,15 @@
 
 #if ENABLE(CG_DISPLAY_LIST_BACKED_IMAGE_BUFFER)
     if (m_parameters.includeDisplayList == IncludeDisplayList::Yes) {
-        BifurcatedGraphicsContext context(m_frontBuffer.imageBuffer->context(), m_displayListBuffer->context());
+        auto& displayListContext = m_displayListBuffer->context();
+
+#if HAVE(CG_DISPLAY_LIST_RESPECTING_CONTENTS_FLIPPED)
+        GraphicsContextStateSaver stateSaver(displayListContext);
+        displayListContext.scale(FloatSize(1, -1));
+        displayListContext.translate(0, -m_parameters.size.height());
+#endif
+
+        BifurcatedGraphicsContext context(m_frontBuffer.imageBuffer->context(), displayListContext);
         drawInContext(context);
         return;
     }