Fix getBBox() returning (0,0) bug when width or height is zero

Source/core/rendering/svg/RenderSVGRect.cpp

Index: Source/core/rendering/svg/RenderSVGRect.cpp
diff --git a/Source/core/rendering/svg/RenderSVGRect.cpp b/Source/core/rendering/svg/RenderSVGRect.cpp
index ce796422d932e7259436a049259b59167932f405..efda77379dbd5ab36a5b81ff9cbf6669f6c096ec 100644
--- a/Source/core/rendering/svg/RenderSVGRect.cpp
+++ b/Source/core/rendering/svg/RenderSVGRect.cpp
@@ -63,7 +63,9 @@ void RenderSVGRect::updateShapeFromElement()
 
     m_usePathFallback = false;
     FloatSize boundingBoxSize(rect->width()->currentValue()->value(lengthContext), rect->height()->currentValue()->value(lengthContext));
-    if (boundingBoxSize.isEmpty())
+
+    // Spec: "A negative value is an error. A value of zero disables rendering of the element."
+    if (boundingBoxSize.isZero() || boundingBoxSize.width() < 0 || boundingBoxSize.height() < 0)
         return;
 
     m_fillBoundingBox = FloatRect(FloatPoint(rect->x()->currentValue()->value(lengthContext), rect->y()->currentValue()->value(lengthContext)), boundingBoxSize);