Specifying a non-zero shape-margin value for an image with an above shape-image-threshold pixels 0,0 (for example) will cause an assertion failure.
Created attachment 215932 [details]
The attached test case demonstrates that the problem is due to specifying a non-zero margin (not shape-margin) for the shape-outside element.
Created attachment 215940 [details]
When margin-top is specified for a shape's element, the Y coordinates passed to RasterShapeIntervals::getExcludedIntervals() may be negative. This is because the incoming logical coordinates are relative to the content or padding box, depending on the box-sizing property. The RasterShape::getExcludedIntervals() method now clips the incoming Y coordinates to the shape's bounds.
Comment on attachment 215940 [details]
Clearing flags on attachment: 215940
Committed r158596: <http://trac.webkit.org/changeset/158596>
All reviewed patches have been landed. Closing bug.