Integer overflows in ObjectBuilder::adjust_alpha_tile_backdrop

[alec-deason]

I'm seeing overflows in this code: https://github.com/servo/pathfinder/blob/master/renderer/src/builder.rs#L609 in both the positive and negative direction.

I don't have a reproducing example yet because I don't have a theory of how I'm triggering the error, so far nothing I've tried has reproduced outside of my full application. While I figure out a minimal case, here's a description of what I'm doing:

I am rendering tree shapes where each tree is constructed out of branches made up of segments. Each segment is a quadralateral. The segments are built as Path2D objects then added to an aggregate Path2D with add_path(segment, &Default::default). That aggregate, representing the entire tree, is filled using fill_path(&tree, FillRule::Winding) Each tree consists of several hundred segments which abut neighboring segments in the same branch, may overlap segments from other branches and will always overlap at forks where two segments connect to the same parent. Trees will usually overlap with each other.

In a scene with 1-10 trees I never see the failure, with 10-20 trees I see it sporadically, with 20+ trees it happens every time I render the scene.

I'm using the latest commit of pathfinder from github, rust nightly, the gl renderer with OpenGL3 on an intel GPU on Linux.