Bug 312777. Don't pass negative-margin-box floats to the space manager; correct them and preserve the right margin-edge on left floats and the left margin-edge on right floats. r+sr=dbaron

layout/generic/nsBlockBandData.cpp

@@ -167,6 +167,7 @@ nsBlockBandData::ComputeAvailSpaceRect()
   }
 
   nsBandTrapezoid* trapezoid = mTrapezoids;
+  // The trapezoid to the left of the first right-floated trapezoid.
   nsBandTrapezoid* rightTrapezoid = nsnull;
 
   PRInt32 leftFloats = 0;
@@ -226,6 +227,9 @@ nsBlockBandData::ComputeAvailSpaceRect()
   mLeftFloats = leftFloats;
   mRightFloats = rightFloats;
 
+  // We look for available space in the last trapezoid before the
+  // first right float, or in the last trapezoid if there is no right
+  // float or no trapezoid before the first right float.
   if (nsnull != rightTrapezoid) {
     trapezoid = rightTrapezoid;
   }

layout/generic/nsBlockReflowState.cpp

@@ -984,6 +984,20 @@ nsBlockReflowState::FlowAndPlaceFloat(nsFloatCache*   aFloatCache,
   }
 
   nsRect region(floatX, floatY, floatSize.width, floatSize.height);
+  
+  // Don't send rectangles with negative margin-box width or height to
+  // the space manager; it can't deal with them.
+  if (region.width < 0) {
+    // Preserve the right margin-edge for left floats and the left
+    // margin-edge for right floats
+    if (isLeftFloat) {
+      region.x = region.XMost();
+    }
+    region.width = 0;
+  }
+  if (region.height < 0) {
+    region.height = 0;
+  }
 #ifdef DEBUG
   nsresult rv =
 #endif
@@ -1023,8 +1037,8 @@ nsBlockReflowState::FlowAndPlaceFloat(nsFloatCache*   aFloatCache,
   // Set the origin of the float frame, in frame coordinates. These
   // coordinates are <b>not</b> relative to the spacemanager
   // translation, therefore we have to factor in our border/padding.
-  nscoord x = borderPadding.left + aFloatCache->mMargins.left + region.x;
-  nscoord y = borderPadding.top + aFloatCache->mMargins.top + region.y;
+  nscoord x = borderPadding.left + aFloatCache->mMargins.left + floatX;
+  nscoord y = borderPadding.top + aFloatCache->mMargins.top + floatY;
 
   // If float is relatively positioned, factor that in as well
   // XXXldb Should this be done after handling the combined area