The cart just echoes what the server stored. A negative line total, a total from a fractional quantity, or an absurdly huge quantity all survive to here because nobody checked the assumption "quantity is a sensible positive integer". Watch the subtotal — if you can make it negative, checkout will pay you.