Layout panic in MutableFlowUtils::store_overflow when `direction` = rtl

[mbrubeck]

When running with the --experimental flag and loading a page that uses the direction property to change the writing mode for an element (e.g. tests/ref/overconstrained_block.html), the layout task panics in store_overflow because it attempts to add a position stored in the parent writing mode to an overflow size stored in the child writing mode:

task 'LayoutWorker worker 1/3' panicked at 'assertion failed: self.mode == other.mode', logical_geometry.rs:114
[Switching to Thread 0x7fff9bdfe700 (LWP 27621)]

Breakpoint 1, 0x0000555556bb9120 in rust_panic ()
(gdb) bt
#0  0x0000555556bb9120 in rust_panic ()
#1  0x0000555556bb97e6 in unwind::begin_unwind_inner::h0e863b3f5b6ff01e7Rd ()
#2  0x00005555559cb7fd in unwind::begin_unwind::h3139588601067146646 ()
#3  0x0000555555a2f2b7 in logical_geometry::DebugWritingMode::check_debug::h5fdbed705d350d3cBDb ()
#4  0x0000555555a332d6 in logical_geometry::LogicalPoint$LT$T$GT$.Add$LT$LogicalSize$LT$T$GT$$C$$x20LogicalPoint$LT$T$GT$$GT$::add::h5012933788839051858 ()
#5  0x0000555555acc8d3 in logical_geometry::LogicalRect$LT$T$GT$::translate::h10341542442764344685
    ()
#6  0x00005555559ea4be in layout::flow::&'a mut Flow+ 'a.MutableFlowUtils::store_overflow (
    self=...) at flow.rs:1189
#7  0x0000555555ba9281 in layout::traversal::AssignBSizesAndStoreOverflow<'a>.PostorderFlowTraversal::process (self=0x7fff9bdfd4f8, flow=...) at traversal.rs:339
#8  0x0000555555ba8ed8 in layout::parallel::ParallelPostorderFlowTraversal::run_parallel<layout::traversal::AssignBSizesAndStoreOverflow> (self=0x7fff9bdfd4f8, unsafe_flow=...) at parallel.rs:229
#9  0x0000555555ba65f6 in layout::parallel::assign_block_sizes_and_store_overflow (
    unsafe_flow=..., proxy=0x7fff9bdfd7d0) at parallel.rs:384

[mbrubeck]

@SimonSapin has a fix for this in progress.

[mbrubeck]

Fixed by #4425.