Fix crash in ObjectPainter::paintOutline in flipped blocks

third_party/WebKit/Source/core/paint/ObjectPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/paint/ObjectPainter.h"
 
 #include "core/layout/LayoutBlock.h"
 #include "core/layout/LayoutInline.h"
 #include "core/layout/LayoutObject.h"
@@ skipping 193 matching lines @@
     if (outlineRects.isEmpty())
         return;
 
     if (LayoutObjectDrawingRecorder::useCachedDrawingIfPossible(*paintInfo.context, m_layoutObject, paintInfo.phase, paintOffset))
         return;
 
     // The result rects are in coordinates of m_layoutObject's border box.
     // Block flipping is not applied yet if !m_layoutObject.isBox().
     if (!m_layoutObject.isBox() && m_layoutObject.styleRef().isFlippedBlocksWritingMode()) {
         LayoutBlock* container = m_layoutObject.containingBlock();
-        if (container)
+        if (container) {
             m_layoutObject.localToContainerRects(outlineRects, container, -paintOffset, paintOffset);
+            if (outlineRects.isEmpty())
+                return;
+        }
     }
 
     Vector<IntRect> pixelSnappedOutlineRects;
     for (auto& r : outlineRects)
         pixelSnappedOutlineRects.append(pixelSnappedIntRect(r));
 
     IntRect unitedOutlineRect = unionRectEvenIfEmpty(pixelSnappedOutlineRects);
     IntRect bounds = unitedOutlineRect;
     bounds.inflate(m_layoutObject.styleRef().outlineOutsetExtent());
     LayoutObjectDrawingRecorder recorder(*paintInfo.context, m_layoutObject, paintInfo.phase, bounds, paintOffset);
@@ skipping 300 matching lines @@
         quad[1] = FloatPoint(x1, y2 - std::max(adjacentWidth2, 0));
         quad[2] = FloatPoint(x2, y2 - std::max(-adjacentWidth2, 0));
         quad[3] = FloatPoint(x2, y1 + std::max(-adjacentWidth1, 0));
         break;
     }
 
     graphicsContext->fillPolygon(4, quad, color, antialias);
 }
 
 } // namespace blink