[CSS Shapes] Negative raster shape height leads to crash

Source/core/rendering/shapes/ShapeOutsideInfo.cpp

Index: Source/core/rendering/shapes/ShapeOutsideInfo.cpp
diff --git a/Source/core/rendering/shapes/ShapeOutsideInfo.cpp b/Source/core/rendering/shapes/ShapeOutsideInfo.cpp
index 5e3e524d5a31077b80f62917154f242e5fdba26b..669ea90d8b169966e9e290ce1b068ea652872c6d 100644
--- a/Source/core/rendering/shapes/ShapeOutsideInfo.cpp
+++ b/Source/core/rendering/shapes/ShapeOutsideInfo.cpp
@@ -103,7 +103,9 @@ static LayoutRect getShapeImageMarginRect(const RenderBox& renderBox, const Layo
 {
     LayoutPoint marginBoxOrigin(-renderBox.marginLogicalLeft() - renderBox.borderAndPaddingLogicalLeft(), -renderBox.marginBefore() - renderBox.borderBefore() - renderBox.paddingBefore());
     LayoutSize marginBoxSizeDelta(renderBox.marginLogicalWidth() + renderBox.borderAndPaddingLogicalWidth(), renderBox.marginLogicalHeight() + renderBox.borderAndPaddingLogicalHeight());
-    return LayoutRect(marginBoxOrigin, referenceBoxLogicalSize + marginBoxSizeDelta);
+    LayoutSize marginRectSize(referenceBoxLogicalSize + marginBoxSizeDelta);
+    marginRectSize.clampNegativeToZero();
+    return LayoutRect(marginBoxOrigin, marginRectSize);
 }
 
 static bool isValidRasterShapeRect(const LayoutRect& rect)