Created attachment 216881 [details] Test case Polygon shape-inside values with less than three vertices and non-zero shape-padding cause an ASSERT crash. The same is true for shape-outside polygons and shape-margin.
Created attachment 216891 [details] Patch PolygonShape::shapePaddingBounds() and PolygonShape::shapeMarginBounds() no longer attempt to compute a new FloatPolygon when the original is empty, i.e. when it has less than three vertices.
Comment on attachment 216891 [details] Patch r=me
Comment on attachment 216891 [details] Patch Clearing flags on attachment: 216891 Committed r159291: <http://trac.webkit.org/changeset/159291>
All reviewed patches have been landed. Closing bug.