[CSS Shapes] inset does not properly clamp large corner radii

Source/core/rendering/shapes/Shape.cpp

 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 82 matching lines @@
     return point.transposedPoint();
 }
 
 static inline FloatSize physicalSizeToLogical(const FloatSize& size, WritingMode writingMode)
 {
     if (isHorizontalWritingMode(writingMode))
         return size;
     return size.transposedSize();
 }
 
-static inline void ensureRadiiDoNotOverlap(FloatRect &bounds, FloatSize &radii)
+static inline void ensureRadiiDoNotOverlap(FloatRect& bounds, FloatSize& radii)
 {
     float widthRatio = bounds.width() / (2 * radii.width());
     float heightRatio = bounds.height() / (2 * radii.height());
     float reductionRatio = std::min<float>(widthRatio, heightRatio);
     if (reductionRatio < 1) {
         radii.setWidth(reductionRatio * radii.width());
         radii.setHeight(reductionRatio * radii.height());
     }
 }
 
@@ skipping 120 matching lines @@
         FloatRect rect(left, top, std::max<float>(boxWidth - left - right, 0), std::max<float>(boxHeight - top - bottom, 0));
         FloatRect logicalRect = physicalRectToLogical(rect, logicalBoxSize.height(), writingMode);
 
         FloatSize boxSize(boxWidth, boxHeight);
         FloatRoundedRect::Radii cornerRadii(
             floatSizeForLengthSize(inset.topLeftRadius(), boxSize),
             floatSizeForLengthSize(inset.topRightRadius(), boxSize),
             floatSizeForLengthSize(inset.bottomLeftRadius(), boxSize),
             floatSizeForLengthSize(inset.bottomRightRadius(), boxSize));
 
+        cornerRadii.scale(calcBorderRadiiConstraintScaleFor(logicalRect, cornerRadii));
+
         shape = createInsetShape(FloatRoundedRect(logicalRect, cornerRadii));
         break;
     }
 
     default:
         ASSERT_NOT_REACHED();
     }
 
     shape->m_writingMode = writingMode;
     shape->m_margin = floatValueForLength(margin, 0);
@@ skipping 50 matching lines @@
     FloatRoundedRect bounds(rect, roundedRect.radii());
     OwnPtr<Shape> shape = createInsetShape(bounds);
     shape->m_writingMode = writingMode;
     shape->m_margin = floatValueForLength(margin, 0);
     shape->m_padding = floatValueForLength(padding, 0);
 
     return shape.release();
 }
 
 } // namespace WebCore