Bug 1914673: Ensure WebRender provides update rects within the bounds of valid rects. r=gw

This is an extra-double-sure clipping of the scissor rect to the valid
rect. This shouldn't matter since the dirty rect is clipped before the
creation of either of the other two rects, but will ensure that rounding
issues from the application of the transform in `get_surface_rect` won't
leave us with  an out-of-bounds scissor rect.

Differential Revision: https://phabricator.services.mozilla.com/D219916

gfx/wr/webrender/src/picture.rs

@@ -5207,18 +5207,18 @@ impl PicturePrimitive {
                             .intersection(&tile.current_descriptor.local_valid_rect)
                             .unwrap_or_else(|| { tile.is_valid = true; PictureRect::zero() });
 
-                        let scissor_rect = frame_state.composite_state.get_surface_rect(
-                            &tile.local_dirty_rect,
-                            &tile.local_tile_rect,
-                            tile_cache.transform_index,
-                        ).to_i32();
-
                         let valid_rect = frame_state.composite_state.get_surface_rect(
                             &tile.current_descriptor.local_valid_rect,
                             &tile.local_tile_rect,
                             tile_cache.transform_index,
                         ).to_i32();
 
+                        let scissor_rect = frame_state.composite_state.get_surface_rect(
+                            &tile.local_dirty_rect,
+                            &tile.local_tile_rect,
+                            tile_cache.transform_index,
+                        ).to_i32().intersection(&valid_rect).unwrap_or_else(|| { Box2D::zero() });
+
                         if tile.is_visible {
                             // Get the world space rect that this tile will actually occupy on screen
                             let world_draw_rect = world_clip_rect.intersection(&tile.world_valid_rect);