[CSS Shapes] Clamp reference box to zero for the reference box calculation in the MarginBox case

[Ahmad Saleem]

Hi Team,

While going through Blink's commit, I came across following:

Commit - https://src.chromium.org/viewvc/blink?view=revision&revision=192180

Webkit Source - https://searchfox.org/wubkat/source/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp#116

If we can add clamping similar to Blink for the cases where due to negative margin on negative width/heights, we can fix assertion and crashes.

Appreciate if someone can confirm if it is worth fixing and I am happy to do PR.

Thanks!

[Radar WebKit Bug Importer]

<rdar://problem/103725054>

[Ahmad Saleem]

This works:

void ShapeOutsideInfo::invalidateForSizeChangeIfNeeded()
{
    auto newSize = computeLogicalBoxSize(m_renderer, m_renderer.containingBlock()->isHorizontalWritingMode());
+++++    newSize.clampNegativeToZero();
    
    if (m_cachedShapeLogicalSize == newSize)
        return;

[Ahmad Saleem]

Confirmed, we don't crash the test case from Blink commit in release and debug (thanks Tim for confirming on debug build).

Marking this as 'RESOLVED WONTFIX'.