[CSS Shapes] shape-outside polygon can fail when line-top intersects a vertex

Source/core/rendering/shapes/PolygonShape.cpp

 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 51 matching lines @@
     if (y == minY())
         return vertex1().y() < vertex2().y() ? vertex1().x() : vertex2().x();
     if (y == maxY())
         return vertex1().y() > vertex2().y() ? vertex1().x() : vertex2().x();
 
     return vertex1().x() + ((y - vertex1().y()) * (vertex2().x() - vertex1().x()) / (vertex2().y() - vertex1().y()));
 }
 
 FloatShapeInterval OffsetPolygonEdge::clippedEdgeXRange(float y1, float y2) const
 {
-    if (!overlapsYRange(y1, y2))
+    if (!overlapsYRange(y1, y2) || (y1 == maxY() && vertex2().y() < vertex1().y()))
         return FloatShapeInterval();
 
     if (isWithinYRange(y1, y2))
         return FloatShapeInterval(minX(), maxX());
 
     // Clip the edge line segment to the vertical range y1,y2 and then return
     // the clipped line segment's horizontal range.
 
     FloatPoint minYVertex;
     FloatPoint maxYVertex;
@@ skipping 45 matching lines @@
     if (m_polygon.isEmpty() || !overlapsYRange(m_polygon.boundingBox(), y1 - shapeMargin(), y2 + shapeMargin()))
         return;
 
     Vector<const FloatPolygonEdge*> overlappingEdges;
     if (!m_polygon.overlappingEdges(y1 - shapeMargin(), y2 + shapeMargin(), overlappingEdges))
         return;
 
     FloatShapeInterval excludedInterval;
     for (unsigned i = 0; i < overlappingEdges.size(); i++) {
         const FloatPolygonEdge& edge = *(overlappingEdges[i]);
+        if (edge.maxY() == edge.minY())
+            continue;
         if (!shapeMargin()) {
             excludedInterval.unite(OffsetPolygonEdge(edge, FloatSize()).clippedEdgeXRange(y1, y2));
         } else {
             excludedInterval.unite(OffsetPolygonEdge(edge, outwardEdgeNormal(edge) * shapeMargin()).clippedEdgeXRange(y1, y2));
             excludedInterval.unite(OffsetPolygonEdge(edge, inwardEdgeNormal(edge) * shapeMargin()).clippedEdgeXRange(y1, y2));
             excludedInterval.unite(clippedCircleXRange(edge.vertex1(), shapeMargin(), y1, y2));
         }
     }
 
     if (!excludedInterval.isEmpty())
         result.append(LineSegment(excludedInterval.x1(), excludedInterval.x2()));
 }
 
 } // namespace WebCore