mspace allows the user to give arbitrary dimensions and thus it is easy to produce assertions with negative values. For example:
We should fix nsMathMLmspaceFrame::Reflow. Note that mspace is cited among the MathML elements that permit "negative spacing" so we will have a bit more to do than just forbidding negative attribute values.
It will however maybe make sense to have the constraint "height >= 0 && width >= 0" rather than the less strict constraint "height + width >= 0". I hardly see how something like:
<mspace height="20px" depth="-10px"/> may be useful for a space.
In that case, the assertions for vertical metrics can be fixed by bug 411227, if we remove the nsMathMLElement::PARSE_ALLOW_NEGATIVE flag when parsing the values of the height/depth attributes.
Created attachment 587421 [details] [diff] [review]
To apply after attachment 587416 [details] [diff] [review]...
Created attachment 587423 [details]
As said in comment 1, I suggest to forbid negative values for height and depth of mspace.
For mspace with negative width, I think we should modify nsMathMLmspaceFrame::Reflow to set
mBoundingMetrics.width = NS_MAX(0, mWidth);
aDesiredSize.width = NS_MAX(0, mWidth);
and this should fix this bug.
Then, if we want to implement negative spaces, we should modify nsMathMLContainerFrame::RowChildFrameIterator to handle mX in a specific manner when mChildFrame->GetContent()->Tag() == == nsGkAtoms::mspace_ with mChildFrame->mWidth < 0. However, I'm not sure it will work when the mspace is a direct child of the <math/> element.
Created attachment 587736 [details] [diff] [review]
Comment on attachment 587736 [details] [diff] [review]
Perhaps mention in one of the comments that nsLineLayout doesn't expect negative widths.
Created attachment 587991 [details] [diff] [review]
Created attachment 624503 [details] [diff] [review]