The following is from Rich in response to the fix for RT-25370:

The CSS background and border spec clearly states no negative values for slices. However the BorderImage doesn't check against negative insets and the JavaDoc doesn't mention it. Can you file another issue for me to resolve that? We should throw an exception on negative slices. Your patch [for RT-25370] at least will handle this by treating negative slices as 0 which is a good thing.