The bug was introduced by 0daa18ab2a, which erroneously changed some signed types to unsigned types, breaking logic involving negative numbers (e.g. when subtracting sizes).
0daa18ab2a