Bug 1712195. Use SafeIntersect. r=aosmond

This uses the new SafeIntersect function
to avoid empty rects that overflow from leaking
through.

Differential Revision: https://phabricator.services.mozilla.com/D116621

gfx/layers/wr/WebRenderCommandBuilder.cpp

@@ -2428,7 +2428,7 @@ Maybe<wr::ImageMask> WebRenderCommandBuilder::BuildWrMaskImage(
       LayerIntRect::FromUnknownRect(
           aMaskItem->GetBuildingRect().ScaleToOutsidePixels(
               scale.width, scale.height, appUnitsPerDevPixel))
-          .Intersect(itemRect);
+          .SafeIntersect(itemRect);
 
   if (visibleRect.IsEmpty()) {
     return Nothing();

gfx/tests/crashtests/large-scaled-mask.html

@@ -0,0 +1,8 @@
+<style>
+* {
+  scale: 48% 41467;
+  border: solid !important;
+  filter: url(#x);
+  -webkit-mask-image: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=)
+}
+</style>