range.getBoundingClientRect() returns incorrect value for collapsed ranges

Source/core/dom/Range.cpp

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 1757 matching lines @@
     }
 }
 
 FloatRect Range::boundingRect() const
 {
     m_ownerDocument->updateLayoutIgnorePendingStylesheets();
 
     Vector<FloatQuad> quads;
     getBorderAndTextQuads(quads);
 
+    if (quads.isEmpty())
+        return FloatRect();
+
     FloatRect result;
-    for (const FloatQuad& quad : quads)
-        result.unite(quad.boundingBox());
+    for (const FloatQuad& quad : quads) {
+        if (result.isEmpty()) {
+            result = quad.boundingBox();
+            continue;
+        }
+
+        result.uniteEvenIfEmpty(quad.boundingBox());
+    }
 
     return result;
 }
 
 DEFINE_TRACE(Range)
 {
     visitor->trace(m_ownerDocument);
     visitor->trace(m_start);
     visitor->trace(m_end);
 }
 
 } // namespace blink
 
 #ifndef NDEBUG
 
 void showTree(const blink::Range* range)
 {
     if (range && range->boundaryPointsValid()) {
         range->startContainer()->showTreeAndMark(range->startContainer(), "S", range->endContainer(), "E");
         fprintf(stderr, "start offset: %d, end offset: %d\n", range->startOffset(), range->endOffset());
     }
 }
 
 #endif