Bug 1788192. Deal with frame/image size overflow and handle it gracefully in border code. r=nical

imgDimension comes directly from the size of the frame, which has overflowed into the negatives. The code wants value to be positive but hasn't considered that imgDimension can be negative.

Differential Revision: https://phabricator.services.mozilla.com/D159138

layout/painting/nsCSSRenderingBorders.cpp

@@ -3845,7 +3845,7 @@ nsCSSBorderImageRenderer::nsCSSBorderImageRenderer(
     if (value < 0) {
       value = 0;
     }
-    if (value > imgDimension) {
+    if (value > imgDimension && imgDimension > 0) {
       value = imgDimension;
     }
     mSlice.Side(s) = value;