Filling a tall rectangle with a gradient asserts in QSpanBuffer::addSpan

To replicate using the fancybrowser example, run "fancybrowser.exe http://labs.wordtothewise.com/painterbug.html".

QtWebkit does a gradient fill of a very large rectangle (one pixel wide by about 309,000 pixels high). This leads to an assertion in QSpanBuffer::addSpan:

ASSERT: "y <= m_clipRect.bottom()" in file painting\qrasterizer.cpp, line 100

Relevant snippet of stack trace:

QtCored4.dll!qFatal(const char * msg, ...) Line 2489 + 0xf bytes C++
QtCored4.dll!qt_assert(const char * assertion, const char * file, int line) Line 2007 + 0x16 bytes C++
QtGuid4.dll!QSpanBuffer::addSpan(int x, unsigned int len, int y, unsigned char coverage) Line 100 + 0x26 bytes C++
QtGuid4.dll!QRasterizer::rasterizeLine(const QPointF & a, const QPointF & b, double width, bool squareCap) Line 894 C++
QtGuid4.dll!QRasterPaintEngine::fillRect(const QRectF & r, QSpanData * data) Line 1788 C++
QtGuid4.dll!QRasterPaintEngine::fillRect(const QRectF & r, const QBrush & brush) Line 1812 C++
QtGuid4.dll!QPainter::fillRect(const QRectF & r, const QBrush & brush) Line 7099 C++
QtWebKitd4.dll!WebCore::Gradient::fill() + 0x65 bytes C++