[mathml] Make elements in MathML namespace use display:math

This CL makes unknown elements in the MathML namespace have
display: math (instead of display: inline). This makes the HTML
sanitizer (relying on the layout object's display in several places)
behave differently i.e. it does not filter out these elements and their
attributes anymore. However, this is ok because these elements are not
treated as HTML/SVG. The clipboard test is changed to check that
nothing is style/executed.

Bug: 6606
Change-Id: I15b1df448c2bdee46c4a36c48a4cfb27d7828ed0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2397949
Commit-Queue: Rob Buis <rbuis@igalia.com>
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Frédéric Wang <fwang@igalia.com>
Cr-Commit-Position: refs/heads/master@{#808250}

third_party/blink/renderer/core/css/mathml.css

@@ -27,6 +27,11 @@
 
 @namespace "http://www.w3.org/1998/Math/MathML";
 
+/* Default display */
+* {
+    display: math;
+}
+
 /* By default, we only display the MathML formulas without any formatting other than the one specified by the display attribute. */
 math {
     display: inline-math;
@@ -47,11 +52,6 @@ math[display="block"] {
     outline: auto 1px -webkit-focus-ring-color;
 }
 
-maction, merror, mfrac, mi, mmultiscripts, mn, mo, mover, mpadded, mphantom, mprescripts, mroot, mrow, ms, msqrt, mspace, mstyle, msub, msup, msubsup, mtext, munder, munderover, none
-{
-    display: math;
-}
-
 mphantom {
     visibility: hidden;
 }

third_party/blink/web_tests/TestExpectations

@@ -1229,7 +1229,6 @@ crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-parameters
 crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-parameters-gap-005.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-parameters-gap-006.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/mrow/inferred-mrow-stretchy.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/mrow/legacy-mfenced-element-001.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/mrow/legacy-mrow-like-elements-001.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/mrow/legacy-mrow-like-elements-002.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/operators/embellished-operator-001.html [ Failure ]

third_party/blink/web_tests/editing/pasteboard/mathml-sanitizer-bypass.html

@@ -18,14 +18,21 @@ if (supportsEditableMathML) {
         'Check whether we have MathML or not');
 }
 
+function hasRedBackground(element) {
+  return window.getComputedStyle(element).
+    getPropertyValue("background-color") == "rgb(255, 0, 0)" ||
+    Array.from(element.children).some(hasRedBackground);
+}
+
 // crbug.com/1011950
 selection_test(
   '<div contenteditable>te|st</div>',
   selection => {
-    selection.setClipboardData('<math><xss style=display:block>t<style>X<a title="</style><img src onerror=alert(1)>">.<a>.');
+    selection.setClipboardData('<math><xss style=display:block>t<style>X<a title="</style><img src onerror=assert_unreached()>">.<a>.');
     selection.document.execCommand('paste');
+    assert_false(hasRedBackground(document.documentElement));
   },
-  '<div contenteditable>te<br>t<img src>">.<a>.|</a>st</div>',
+  '<div contenteditable>te<math><xss style="display:block"><style>X<a title="</style><img src onerror=assert_unreached()>">.<a></a></a></style></xss></math>t|st</div>',
   'Paste blocks script injection');
 
 // crbug.com/1017871
@@ -34,8 +41,9 @@ selection_test(
   selection => {
     selection.setClipboardData('<math><xss style=display:block>t<style>X<a title="</style><style>*{background:red}</style>">.<a>.');
     selection.document.execCommand('paste');
+    assert_false(hasRedBackground(document.documentElement));
   },
-  '<div contenteditable>te<br>t">.<a>.|</a>st</div>',
+  '<div contenteditable>te<math><xss style="display:block"><style>X<a title="</style><style>*{background:red}</style>">.<a></a></a></style></xss></math>t|st</div>',
   'Paste blocks HTML style injection');
 
 // crbug.com/1017871
@@ -44,9 +52,11 @@ selection_test(
   selection => {
     selection.setClipboardData('A<math>B<a style=display:block>C<title>D<a id="</title><svg><style>*{background:red}</style>">c');
     selection.document.execCommand('paste');
+    assert_false(hasRedBackground(document.documentElement));
   },
   supportsEditableMathML
-    ? '<div contenteditable>teA<br>C|<svg></svg>st</div>'
+    ? '<div contenteditable>teA<math>B<a style="display:block"><title>D<a id="</title><svg><style>*{background:red}</style>"></a></title></a></math>C|st</div>'
     : '<div contenteditable>teA<math>B<br></math>C|<svg></svg>st</div>',
   'Paste blocks SVG style injection');
+
 </script>

third_party/blink/web_tests/external/wpt/mathml/presentation-markup/mrow/mrow-preferred-width-expected.txt

-This is a testharness.js-based test.
-FAIL Preferred width of mrow with mspace children assert_approx_equals: unknown expected 15 +/- 1 but got 30
-PASS Preferred width of mrow with mn and mo children
-Harness: the test ran to completion.
-

third_party/blink/web_tests/external/wpt/mathml/presentation-markup/mrow/spacing-expected.txt

-This is a testharness.js-based test.
-PASS operator spacing inside Mrow
-PASS operator spacing inside Sqrt
-PASS operator spacing inside Style
-PASS operator spacing inside Error
-PASS operator spacing inside Phantom
-PASS operator spacing inside Math
-FAIL operator spacing inside Menclose assert_greater_than_equal: expected a number greater than or equal to 50 but got -8
-PASS operator spacing inside Mpadded
-FAIL operator spacing inside Unknown assert_greater_than_equal: expected a number greater than or equal to 50 but got -8
-Harness: the test ran to completion.
-