Authors can set negative visible rectangle values via VideoFrame(Buffer,)Init.visibleRect. https://w3c.github.io/webcodecs/#validate-videoframeinit checks that this isn't the case, but other paths use visibleRect without validating, such as Parse VideoFrameCopyToOptions and the VideoFrame ctor that takes aCanvasImageSource as argument.