The original test was provided by the u-szeged fuzzer. I reduced the test case and handled the negative margin-IntRect case in the shapes code.
Created attachment 236839 [details] backtrace
Created attachment 236842 [details] Patch
Comment on attachment 236842 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=236842&action=review Given the complexity of the test case, I'm not convinced this is the proper fix. > Source/WebCore/ChangeLog:9 > + The original test was provided by the u-szeged fuzzer. I reduced the test > + case and handled the negative margin-IntRect case in the shapes code. Can you give a better description of what this is fixing? > LayoutTests/fast/shapes/shape-outside-floats/shape-outside-raster-shape-negative-height.html:3 > +* { This test seems way too complex, especially since you're matching everything here. Are you sure you couldn't get something simpler? If you can't reduce it to simply a single float with shape-outside and a negative height margin box, I wonder if there is something more complex here than just having the height be negative. Is there a condition before it even gets to the shapes code that is failing? > LayoutTests/fast/shapes/shape-outside-floats/shape-outside-raster-shape-negative-height.html:17 > +<button>a</button> Does this have to be a button for this to fail, or would a <span> work? (Or do you even need it at all?) > LayoutTests/fast/shapes/shape-outside-floats/shape-outside-raster-shape-negative-height.html:20 > +<p style="position: absolute; top: 100px;"> I wouldn't muck around with absolute positioning. Just have this paragraph in here, and dumpAsText() the entire test. You're not gaining anything from it being a ref test except complexity.
Created attachment 244174 [details] Cleaned up test case
Created attachment 244179 [details] Patch
Comment on attachment 244179 [details] Patch Thanks! Looks good!
Comment on attachment 244179 [details] Patch Clearing flags on attachment: 244179 Committed r178054: <http://trac.webkit.org/changeset/178054>
All reviewed patches have been landed. Closing bug.