[mathml] Store mspace height in computed style

Previously we used vertical-align and SetInlineStyleProperty
to pass mspace height to the mspace layout algorithm, which was
a bit of a hack and due to SetInlineStyleProperty probably
caused security bug 1054765.
To fix this store mspace height as math baseline on computed style, setting it in the style adjuster.

Bug: 6606, 1054765
Change-Id: I87b7be8b5ed6d0b66b62ed9efb223cb4fc51f696
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2068599Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Commit-Queue: Rob Buis <rbuis@igalia.com>
Cr-Commit-Position: refs/heads/master@{#743903}

third_party/blink/renderer/core/css/resolver/style_adjuster.cc

@@ -54,6 +54,7 @@
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/layout/layout_replaced.h"
 #include "third_party/blink/renderer/core/layout/layout_theme.h"
+#include "third_party/blink/renderer/core/mathml/mathml_space_element.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/style/computed_style_constants.h"
 #include "third_party/blink/renderer/core/svg/svg_svg_element.h"
@@ -772,6 +773,8 @@ void StyleAdjuster::AdjustComputedStyle(StyleResolverState& state,
       // https://drafts.csswg.org/css-display/#unbox-mathml
       style.SetDisplay(EDisplay::kNone);
     }
+    if (auto* space = DynamicTo<MathMLSpaceElement>(*element))
+      space->AddMathBaselineIfNeeded(style, state.CssToLengthConversionData());
   }
 
   // If this node is sticky it marks the creation of a sticky subtree, which we

third_party/blink/renderer/core/layout/ng/mathml/ng_math_space_layout_algorithm.cc

@@ -30,7 +30,7 @@ scoped_refptr<const NGLayoutResult> NGMathSpaceLayoutAlgorithm::Layout() {
 
   container_builder_.SetBaseline(
       border_padding_.block_start +
-      ValueForLength(Style().GetVerticalAlignLength(), LayoutUnit()));
+      ValueForLength(Style().GetMathBaseline(), LayoutUnit()));
   return container_builder_.ToBoxFragment();
 }
 

third_party/blink/renderer/core/mathml/mathml_space_element.cc

@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/mathml/mathml_space_element.h"
 
+#include "third_party/blink/renderer/core/css/parser/css_parser.h"
 #include "third_party/blink/renderer/core/layout/ng/mathml/layout_ng_mathml_block.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 
@@ -12,6 +13,23 @@ namespace blink {
 MathMLSpaceElement::MathMLSpaceElement(Document& doc)
     : MathMLElement(mathml_names::kMspaceTag, doc) {}
 
+void MathMLSpaceElement::AddMathBaselineIfNeeded(
+    ComputedStyle& style,
+    const CSSToLengthConversionData& conversion_data) {
+  if (!FastHasAttribute(mathml_names::kHeightAttr))
+    return;
+  auto string = FastGetAttribute(mathml_names::kHeightAttr);
+  const CSSValue* parsed = CSSParser::ParseSingleValue(
+      CSSPropertyID::kHeight, string,
+      StrictCSSParserContext(GetDocument().GetSecureContextMode()));
+  const auto* new_value = DynamicTo<CSSPrimitiveValue>(parsed);
+  if (!new_value || !new_value->IsLength())
+    return;
+  Length length_or_percentage_value =
+      new_value->ConvertToLength(conversion_data);
+  style.SetMathBaseline(std::move(length_or_percentage_value));
+}
+
 bool MathMLSpaceElement::IsPresentationAttribute(
     const QualifiedName& name) const {
   if (name == mathml_names::kWidthAttr || name == mathml_names::kHeightAttr ||
@@ -41,9 +59,6 @@ void MathMLSpaceElement::CollectStyleForPresentationAttribute(
       AddPropertyToPresentationAttributeStyle(style, CSSPropertyID::kHeight,
                                               value);
     }
-    if (name == mathml_names::kHeightAttr) {
-      SetInlineStyleProperty(CSSPropertyID::kVerticalAlign, value, false);
-    }
   } else {
     MathMLElement::CollectStyleForPresentationAttribute(name, value, style);
   }

third_party/blink/renderer/core/mathml/mathml_space_element.h

@@ -11,11 +11,15 @@ namespace blink {
 
 class LayoutObject;
 class ComputedStyle;
+class CSSToLengthConversionData;
 
 class MathMLSpaceElement final : public MathMLElement {
  public:
   explicit MathMLSpaceElement(Document&);
 
+  void AddMathBaselineIfNeeded(ComputedStyle&,
+                               const CSSToLengthConversionData&);
+
  private:
   LayoutObject* CreateLayoutObject(const ComputedStyle&,
                                    LegacyLayout legacy) override;

third_party/blink/renderer/core/style/computed_style_extra_fields.json5

@@ -1046,5 +1046,14 @@
       default_value: "false",
       inherited: false,
     },
+    {
+      name: "MathBaseline",
+      field_template: "external",
+      default_value: "Length()",
+      include_paths: ["third_party/blink/renderer/platform/geometry/length.h"],
+      type_name: "Length",
+      field_group: "*",
+      getter: "GetMathBaseline",
+    },
   ],
 }