mspace allows the user to give arbitrary dimensions and thus it is easy to produce assertions with negative values. For example: <mspace width="-10px"/> <mspace height="-10px"/> We should fix nsMathMLmspaceFrame::Reflow. Note that mspace is cited among the MathML elements that permit "negative spacing" so we will have a bit more to do than just forbidding negative attribute values.
It will however maybe make sense to have the constraint "height >= 0 && width >= 0" rather than the less strict constraint "height + width >= 0". I hardly see how something like: <mspace height="20px" depth="-10px"/> may be useful for a space. In that case, the assertions for vertical metrics can be fixed by bug 411227, if we remove the nsMathMLElement::PARSE_ALLOW_NEGATIVE flag when parsing the values of the height/depth attributes.
Created attachment 587421 [details] [diff] [review] crashtest To apply after attachment 587416 [details] [diff] [review]...
As said in comment 1, I suggest to forbid negative values for height and depth of mspace. For mspace with negative width, I think we should modify nsMathMLmspaceFrame::Reflow to set mBoundingMetrics.width = NS_MAX(0, mWidth); aDesiredSize.width = NS_MAX(0, mWidth); and this should fix this bug. Then, if we want to implement negative spaces, we should modify nsMathMLContainerFrame::RowChildFrameIterator to handle mX in a specific manner when mChildFrame->GetContent()->Tag() == == nsGkAtoms::mspace_ with mChildFrame->mWidth < 0. However, I'm not sure it will work when the mspace is a direct child of the <math/> element.
Created attachment 587736 [details] [diff] [review] Patch V1
Comment on attachment 587736 [details] [diff] [review] Patch V1 Perhaps mention in one of the comments that nsLineLayout doesn't expect negative widths.
Created attachment 587991 [details] [diff] [review] Patch V2
Created attachment 624503 [details] [diff] [review] Patch V3