In r83422 I attempted to replace the safeFloatToInt() in FloatRect.app with a call to clampToInteger(float), but that gives the wrong result if the input is already INT_MAX.
Created attachment 94499 [details] Patch
Committed r87103: <http://trac.webkit.org/changeset/87103>