[CSS Shapes] Negative raster shape height leads to crash

Source/core/rendering/shapes/ShapeOutsideInfo.cpp

 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 85 matching lines @@
     String urlString = url.isNull() ? "''" : url.elidedString();
     document.addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Unsafe attempt to load URL " + urlString + "."));
 
     return false;
 }
 
 static LayoutRect getShapeImageMarginRect(const RenderBox& renderBox, const LayoutSize& referenceBoxLogicalSize)
 {
     LayoutPoint marginBoxOrigin(-renderBox.marginLogicalLeft() - renderBox.borderAndPaddingLogicalLeft(), -renderBox.marginBefore() - renderBox.borderBefore() - renderBox.paddingBefore());
     LayoutSize marginBoxSizeDelta(renderBox.marginLogicalWidth() + renderBox.borderAndPaddingLogicalWidth(), renderBox.marginLogicalHeight() + renderBox.borderAndPaddingLogicalHeight());
-    return LayoutRect(marginBoxOrigin, referenceBoxLogicalSize + marginBoxSizeDelta);
+    LayoutSize marginRectSize(referenceBoxLogicalSize + marginBoxSizeDelta);
+    marginRectSize.clampNegativeToZero();
+    return LayoutRect(marginBoxOrigin, marginRectSize);
 }
 
 static bool isValidRasterShapeRect(const LayoutRect& rect)
 {
     static double maxImageSizeBytes = 0;
     if (!maxImageSizeBytes) {
         size_t size32MaxBytes =  0xFFFFFFFF / 4; // Some platforms don't limit maxDecodedImageBytes.
         maxImageSizeBytes = std::min(size32MaxBytes, Platform::current()->maxDecodedImageBytes());
     }
     return (rect.width().toFloat() * rect.height().toFloat() * 4.0) < maxImageSizeBytes;
@@ skipping 224 matching lines @@
 }
 
 FloatSize ShapeOutsideInfo::shapeToRendererSize(FloatSize size) const
 {
     if (!m_renderer.style()->isHorizontalWritingMode())
         return size.transposedSize();
     return size;
 }
 
 } // namespace blink