https://github.com/servo/webrender/pull/3192 will help with diagnosing this.

I can reproduce this with tiled blob images: https://treeherder.mozilla.org/#/jobs?repo=try&revision=9e2e5b4d7eb112055060a6d606fc0e01487f4bdf&selectedJob=204993161 (lldb) p *visible_area (euclid::rect::TypedRect<u32, webrender_api::units::DevicePixel>) $10 = { origin = { x = 113250 y = 26843548 } size = { width = 1601 height = 2001 } } Dividing y by the tile_size (256) gives us a number that's still too big for a u16 (104857), and then we panic.

This issue has also been found by a fuzzer. Would a testcase be useful at this point? I ask because I'll need to do it locally.

(In reply to Tyson Smith [:tsmith] from comment #3) > This issue has also been found by a fuzzer. Would a testcase be useful at > this point? I ask because I'll need to do it locally. Yes, a test case would be useful. Thanks.

Here is a reduced test case. It only reproduces on older builds. FWIW our fuzzers have not hit this issues since Oct 29.

With blob tiling enabled, this is covered by the existing crashtest xpcom/string/crashtests/1113005.html, and is now fixed.