Treat mmultiscripts with two <mprescripts> children as invalid

Per [1], mmultiscripts can only have one in-flow <mprescripts/> child so this CL fixes IsValidMultiscript() to align with the specification. It also makes similar adjustment for the corresponding fatal checks in NGMathScriptsLayoutAlgorithm::GatherChildren (rather than just checking the index of a previous <mprescripts> is nonzero, which does not work if there is no post-scripts). This fixes an assertion about node not being laid out due to the fact that the mmultiscripts algorithm only performs layout of at most one <mprescript>. [1] https://mathml-refresh.github.io/mathml-core/#prescripts-and-tensor-indices-mmultiscripts Bug: 1158375, 6606 Change-Id: I26964b2ef287585392db7f1854251b4b21075aef Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2593643 Commit-Queue: Frédéric Wang <fwang@igalia.com> Reviewed-by: Morten Stenshorne <mstensho@chromium.org> Cr-Commit-Position: refs/heads/master@{#837987}

Treat mmultiscripts with two <mprescripts> children as invalid
Per [1], mmultiscripts can only have one in-flow <mprescripts/> child so this CL fixes IsValidMultiscript() to align with the specification. It also makes similar adjustment for the corresponding fatal checks in NGMathScriptsLayoutAlgorithm::GatherChildren (rather than just checking the index of a previous <mprescripts> is nonzero, which does not work if there is no post-scripts). This fixes an assertion about node not being laid out due to the fact that the mmultiscripts algorithm only performs layout of at most one <mprescript>. [1] https://mathml-refresh.github.io/mathml-core/#prescripts-and-tensor-indices-mmultiscripts Bug: 1158375, 6606 Change-Id: I26964b2ef287585392db7f1854251b4b21075aef Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2593643 Commit-Queue: Frédéric Wang <fwang@igalia.com> Reviewed-by: Morten Stenshorne <mstensho@chromium.org> Cr-Commit-Position: refs/heads/master@{#837987}
ef8fbdd7 · Frédéric Wang · Chromium LUCI CQ · f48f030a · ef8fbdd7 · ef8fbdd7
Commit ef8fbdd7 authored Dec 17, 2020 by Frédéric Wang Committed by Chromium LUCI CQ Dec 17, 2020
3 changed files
--- a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.cc
+++ b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.cc
@@ -79,13 +79,15 @@ inline bool IsValidMultiscript(const NGBlockNode& node) {
  if (!child || IsPrescriptDelimiter(child))
    return false;
  bool number_of_scripts_is_even = true;
+  bool prescript_delimiter_found = false;
  while (child) {
    child = To<NGBlockNode>(NextSiblingInFlow(child));
    if (!child)
      continue;
    if (IsPrescriptDelimiter(child)) {
-      if (!number_of_scripts_is_even)
+      if (!number_of_scripts_is_even || prescript_delimiter_found)
        return false;
+      prescript_delimiter_found = true;
      continue;
    }
    number_of_scripts_is_even = !number_of_scripts_is_even;

--- a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_scripts_layout_algorithm.cc
+++ b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_scripts_layout_algorithm.cc
@@ -148,7 +148,7 @@ void NGMathScriptsLayoutAlgorithm::GatherChildren(
        // The structure of mmultiscripts is specified here:
        // https://mathml-refresh.github.io/mathml-core/#prescripts-and-tensor-indices-mmultiscripts
        if (IsPrescriptDelimiter(block_child)) {
-          if (!number_of_scripts_is_even || *first_prescript_index > 0) {
+          if (!number_of_scripts_is_even || *prescripts) {
            NOTREACHED();
            return;
          }

--- a/third_party/blink/web_tests/external/wpt/mathml/crashtests/mmultiscripts-with-two-prescripts.html
+++ b/third_party/blink/web_tests/external/wpt/mathml/crashtests/mmultiscripts-with-two-prescripts.html
+<!DOCTYPE html>
+<math>
+  <mmultiscripts>
+    <mrow></mrow>
+    <mprescripts></mprescripts>
+    <mprescripts></mprescripts>
+  </mmultiscripts>
+</math>