716349 - ASSERTION: 'bad height: 'metrics.height>=0' and ASSERTION: bad width: 'metrics.width>=0' with mspace

Status: RESOLVED FIXED

(Core :: MathML, defect)

Description

[Frédéric Wang (:fredw)]

mspace allows the user to give arbitrary dimensions and thus it is easy to produce assertions with negative values. For example:

<mspace width="-10px"/>
<mspace height="-10px"/>

We should fix nsMathMLmspaceFrame::Reflow. Note that mspace is cited among the MathML elements that permit "negative spacing" so we will have a bit more to do than just forbidding negative attribute values.

Comment 1

[Frédéric Wang (:fredw)]

It will however maybe make sense to have the constraint "height >= 0 && width >= 0" rather than the less strict constraint "height + width >= 0". I hardly see how something like:

<mspace height="20px" depth="-10px"/> may be useful for a space.

In that case, the assertions for vertical metrics can be fixed by bug 411227, if we remove the nsMathMLElement::PARSE_ALLOW_NEGATIVE flag when parsing the values of the height/depth attributes.

Comment 2

[Frédéric Wang (:fredw)]

Attachment: crashtest

To apply after attachment 587416 [details] [diff] [review]...

Comment 3

[Frédéric Wang (:fredw)]

Attachment: testcase

Comment 4

[Frédéric Wang (:fredw)]

As said in comment 1, I suggest to forbid negative values for height and depth of mspace.

For mspace with negative width, I think we should modify nsMathMLmspaceFrame::Reflow to set

mBoundingMetrics.width = NS_MAX(0, mWidth);
aDesiredSize.width = NS_MAX(0, mWidth);

and this should fix this bug.

Then, if we want to implement negative spaces, we should modify nsMathMLContainerFrame::RowChildFrameIterator to handle mX in a specific manner when mChildFrame->GetContent()->Tag() == == nsGkAtoms::mspace_ with mChildFrame->mWidth < 0. However, I'm not sure it will work when the mspace is a direct child of the <math/> element.

Comment 5

[Frédéric Wang (:fredw)]

Attachment: Patch V1

Comment 6

[Karl Tomlinson (:karlt)]

Comment on attachment 587736 [details] [diff] [review]
Patch V1

Perhaps mention in one of the comments that nsLineLayout doesn't expect negative widths.

Comment 7

[Frédéric Wang (:fredw)]

Attachment: Patch V2

Comment 8

[Frédéric Wang (:fredw)]

Attachment: Patch V3

Comment 9

[Frédéric Wang (:fredw)]

https://tbpl.mozilla.org/?tree=Try&rev=ec77d578bc5b

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1213ffc89007
https://hg.mozilla.org/integration/mozilla-inbound/rev/aa0630695d1b

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1213ffc89007
https://hg.mozilla.org/mozilla-central/rev/aa0630695d1b