Specifying a non-zero shape-margin value for an image with an above shape-image-threshold pixels 0,0 (for example) will cause an assertion failure.
Created attachment 215932 [details] Test case. The attached test case demonstrates that the problem is due to specifying a non-zero margin (not shape-margin) for the shape-outside element.
Created attachment 215940 [details] Patch When margin-top is specified for a shape's element, the Y coordinates passed to RasterShapeIntervals::getExcludedIntervals() may be negative. This is because the incoming logical coordinates are relative to the content or padding box, depending on the box-sizing property. The RasterShape::getExcludedIntervals() method now clips the incoming Y coordinates to the shape's bounds.
Comment on attachment 215940 [details] Patch Clearing flags on attachment: 215940 Committed r158596: <http://trac.webkit.org/changeset/158596>
All reviewed patches have been landed. Closing bug.