Preventing hight for drawing from becoming negative when face->dy < 0. The

height value is used in miFillPolyHelper() to calculate the size of
    memory to be allocated. A negative value will lead to a crash (Bugzilla
    #2690, Keith Packard, Egbert Eich).

mi/miwideline.c

@@ -1168,6 +1168,10 @@ miLineProjectingCap (pDrawable, pGC, pixel, spanData, face, isLeft, xorg, yorg,
     }
     else if (dx == 0)
     {
+	if (dy < 0) {
+	    dy = -dy;
+	    isLeft = !isLeft;
+	}
 	topy = yorgi;
 	bottomy = yorgi + dy;
 	if (isLeft)