Clamp shape-margin to zero

Source/core/layout/shapes/ShapeOutsideInfo.cpp

 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 135 matching lines @@
     if (Shape* shape = m_shape.get())
         return *shape;
 
     TemporaryChange<bool> isInComputingShape(m_isComputingShape, true);
 
     const ComputedStyle& style = *m_layoutBox.style();
     ASSERT(m_layoutBox.containingBlock());
     const ComputedStyle& containingBlockStyle = *m_layoutBox.containingBlock()->style();
 
     WritingMode writingMode = containingBlockStyle.writingMode();
-    LayoutUnit maximumValue = m_layoutBox.containingBlock() ? m_layoutBox.containingBlock()->contentWidth() : LayoutUnit();
+    // Make sure contentWidth is not negative. This can happen when containing block has a vertical scrollbar and
+    // its content is smaller than the scrollbar width.
+    LayoutUnit maximumValue = m_layoutBox.containingBlock() ? std::max(LayoutUnit(), m_layoutBox.containingBlock()->contentWidth()) : LayoutUnit();
     float margin = floatValueForLength(m_layoutBox.style()->shapeMargin(), maximumValue.toFloat());
 
     float shapeImageThreshold = style.shapeImageThreshold();
     ASSERT(style.shapeOutside());
     const ShapeValue& shapeValue = *style.shapeOutside();
 
     switch (shapeValue.type()) {
     case ShapeValue::Shape:
         ASSERT(shapeValue.shape());
         m_shape = Shape::createShape(shapeValue.shape(), m_referenceBoxLogicalSize, writingMode, margin);
@@ skipping 178 matching lines @@
 }
 
 FloatSize ShapeOutsideInfo::shapeToLayoutObjectSize(FloatSize size) const
 {
     if (!m_layoutBox.style()->isHorizontalWritingMode())
         return size.transposedSize();
     return size;
 }
 
 } // namespace blink