--- a/content/canvas/compiledtest/TestWebGLElementArrayCache.cpp
+++ b/content/canvas/compiledtest/TestWebGLElementArrayCache.cpp
@@ -110,32 +110,56 @@ void CheckSanity()
     data[i] = numElems - i;
   c.BufferData(data, numBytes);
   VERIFY( c.Validate(type, numElems,     0, numElems));
   VERIFY(!c.Validate(type, numElems - 1, 0, numElems));
 
   MOZ_ASSERT(numElems > 10);
   VERIFY( c.Validate(type, numElems - 10, 10, numElems - 10));
   VERIFY(!c.Validate(type, numElems - 11, 10, numElems - 10));
+}
+
+template<typename T>
+void CheckUintOverflow()
+{
+  // This test is only for integer types smaller than uint32_t
+  MOZ_STATIC_ASSERT(sizeof(T) < sizeof(uint32_t), "This test is only for integer types \
+                    smaller than uint32_t");
+
+  const size_t numElems = 64; // should be significantly larger than tree leaf size to
+                              // ensure we exercise some nontrivial tree-walking
+  T data[numElems];
+  size_t numBytes = numElems * sizeof(T);
+  MOZ_ASSERT(numBytes == sizeof(data));
+
+  GLenum type = GLType<T>();
+
+  WebGLElementArrayCache c;
+
+  for(size_t i = 0; i < numElems; i++)
+    data[i] = numElems - i;
+  c.BufferData(data, numBytes);
 
   // bug 825205
-  if (sizeof(T) < sizeof(uint32_t)) {
-    uint32_t bigValWrappingToZero = uint32_t(T(-1)) + 1;
-    VERIFY(c.Validate(type, bigValWrappingToZero,     0, numElems));
-    VERIFY(c.Validate(type, bigValWrappingToZero - 1, 0, numElems));
-  }
+  uint32_t bigValWrappingToZero = uint32_t(T(-1)) + 1;
+  VERIFY( c.Validate(type, bigValWrappingToZero,     0, numElems));
+  VERIFY( c.Validate(type, bigValWrappingToZero - 1, 0, numElems));
+  VERIFY(!c.Validate(type,                        0, 0, numElems));
 }
 
 int main(int argc, char *argv[])
 {
   srand(0); // do not want a random seed here.
 
   CheckSanity<uint8_t>();
   CheckSanity<uint16_t>();
 
+  CheckUintOverflow<uint8_t>();
+  CheckUintOverflow<uint16_t>();
+
   nsTArray<uint8_t> v, vsub;
   WebGLElementArrayCache b;
 
   for (int maxBufferSize = 1; maxBufferSize <= 4096; maxBufferSize *= 2) {
     // See bug 800612. We originally had | repeat = min(maxBufferSize, 20) |
     // and a real bug was only caught on Windows and not on Linux due to rand()
     // producing different values. In that case, the minimum value by which to replace
     // this 20 to reproduce the bug on Linux, was 25. Replacing it with 64 should give