Bug 1765667 - Clamp surface size of content tiles for backdrop-filter r=gfx-reviewers,lsalzman

Differential Revision: https://phabricator.services.mozilla.com/D145047

gfx/tests/crashtests/1765667.html

@@ -0,0 +1,4 @@
+<style>
+* { backdrop-filter: drop-shadow(15em 17454.938982935513ex mediumpurple); }
+</style>
+

gfx/tests/crashtests/crashtests.list

@@ -212,3 +212,4 @@ load 1745775.html
 load 1757002.html
 load 1758127-1.html
 load 1762973-1.html
+pref(layout.css.backdrop-filter.enabled,true) load 1765667.html

gfx/wr/webrender/src/picture.rs

@@ -4827,9 +4827,25 @@ impl PicturePrimitive {
                                         }
                                     }
 
+                                    // We know that we'll never need to sample > 300 device pixels outside the tile
+                                    // for blurring, so clamp the content rect here so that we don't try to allocate
+                                    // a really large surface in the case of a drop-shadow with large offset.
+                                    let max_content_rect = (tile.local_dirty_rect.cast_unit() * device_pixel_scale)
+                                        .inflate(
+                                            MAX_BLUR_RADIUS * BLUR_SAMPLE_SCALE,
+                                            MAX_BLUR_RADIUS * BLUR_SAMPLE_SCALE,
+                                        )
+                                        .round_out()
+                                        .to_i32();
+
                                     let content_device_rect = (local_content_rect.cast_unit() * device_pixel_scale)
                                         .round_out()
                                         .to_i32();
+
+                                    let content_device_rect = content_device_rect
+                                        .intersection(&max_content_rect)
+                                        .expect("bug: no intersection with tile dirty rect");
+
                                     let content_task_size = content_device_rect.size();
                                     let normalized_content_rect = content_task_size.into();