The attached testcase causes a panic in m-c rev 07484bfdb96b with stylo enabled by pref. thread '<unnamed>' panicked at 'attempt to subtract with overflow', /home/worker/workspace/build/src/obj-firefox/toolkit/library/x86_64-unknown-linux-gnu/debug/build/style-a3e69c1fe576a835/out/gecko_properties.rs:13683 stack backtrace: 0: std::sys::imp::backtrace::tracing::imp::unwind_backtrace 1: std::sys_common::backtrace::_print 2: std::panicking::default_hook::{{closure}} 3: std::panicking::default_hook 4: std::panicking::rust_panic_with_hook 5: std::panicking::begin_panic 6: std::panicking::begin_panic_fmt 7: rust_begin_unwind 8: core::panicking::panic_fmt 9: core::panicking::panic 10: style::gecko_properties::<impl style::gecko_bindings::structs::root::mozilla::GeckoEffects>::set_clip 11: style::properties::StyleBuilder::set_clip 12: style::properties::longhands::clip::cascade_property 13: style::properties::apply_declarations 14: style::properties::cascade 15: <style::style_resolver::StyleResolverForElement<'a, 'ctx, 'le, E>>::cascade_style 16: <style::style_resolver::StyleResolverForElement<'a, 'ctx, 'le, E>>::resolve_primary_style 17: <style::style_resolver::StyleResolverForElement<'a, 'ctx, 'le, E>>::resolve_style 18: style::traversal::resolve_style 19: Servo_ResolveStyleLazily

https://hg.mozilla.org/mozilla-central/rev/7ad0f4024a8a (dropped off #bugherder's radar, resolve by hand.)