MathML: check LayoutObject tree for comment-split <mo> when layout [chromium/src : main]

0 views
Skip to first unread message

THANK FLY (Gerrit)

unread,
Apr 21, 2026, 12:32:04 AM (yesterday) Apr 21
to Eri Pazos Pérez, android-bu...@system.gserviceaccount.com, Frédéric Wang Nélar, Ian Kilpatrick, Morten Stenshorne, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-revi...@chromium.org, blink-...@chromium.org, zol...@webkit.org
Attention needed from Frédéric Wang Nélar, Morten Stenshorne and Philip Rogers

THANK FLY added 4 comments

Patchset-level comments
File-level comment, Patchset 3:
Frédéric Wang Nélar . resolved

So the relevant spec text is here:

https://w3c.github.io/mathml-core/#layout-of-operators
> If the content of the <mo> element is not made of a single character c then fall back to the layout algorithm of 3.2.1.1 Layout of <mtext>.

https://w3c.github.io/mathml-core/#layout-of-mtext
> If the <mtext> element contains only text content without forced line break or soft wrap opportunity then, the anonymous child node generated for that text is laid out as defined in the relevant CSS specification and

I don't understand what "floating" means here? The mo in the test case has multiple character and a line breaking, so indeed it should not be laid out using the MathML-specific code per the above text. But I don't see any floating elements there (and I think we handle float property as per https://w3c.github.io/mathml-core/#css-styling).

Also, it seems you are excluding cases when there are multiple in-flow text nodes but I don't see anything for that in the spec. Does the parenthesis still stretch in the following case with two text nodes in the DOM?

```
<math><mrow><mo id="mo2"></mo><mfrac><mfrac><mn>1</mn><mn>2</mn></mfrac><mfrac><mn>3</mn><mn>4</mn></mfrac></mfrac></mrow></math>
<script>
mo2.appendChild(document.createTextNode("("));
mo2.appendChild(document.createTextNode("")); // empty
</script>
```
THANK FLY

Sorry for the delay in getting back to this issue.
Regarding the float issue you mentioned, it was caused by other HTML content I included in previous tests. It can actually be ignored. Sorry for the confusion.

I have adjusted the fix approach. Currently, we ensure only one layout node exists when entering the MathTokenLayoutAlgorithm by checking that there is exactly one Layout object. This guarantees correct rendering and prevents crashes.

I’ve also tested the test case you sent with the empty node. There should effectively be only one valid layout node in practice, so it will stretch normally now.

Commit Message
Line 7, Patchset 3:Fix(mathml): Fix text node detection logic to properly handle floating
elements.
Morten Stenshorne . resolved

```suggestion
[mathml] Text node detection logic to properly handle floating elements.
```

Maybe that fits on one line?

THANK FLY

Hi I adjusted it now. Sorry I didn’t get a chance to handle this issue earlier. I have revised it recently. Could you please review it again?

Line 21, Patchset 3:After the fix: renders "!→" without dcheck
Morten Stenshorne . resolved

This suggests that this is fixing a correctness issue. So how about a correctness test, and not just a crash test?

THANK FLY

Now add a mathml_operator_element_test.cc for correctness test.

File third_party/blink/renderer/core/layout/mathml/math_layout_utils.cc
Line 238, Patchset 3: if (!node.IsBlock() || !node.IsMathML() || !node.FirstChild().IsInline())
Morten Stenshorne . resolved

This is a rather useless check, given that the parameter is `BlockNode`. Maybe replace with `!node.IsBlockFlow()` here, instead of the dynamic LayoutBlockFlow cast below.

THANK FLY

I have adjusted the fix approach. Currently, we ensure only one layout node exists when entering the MathTokenLayoutAlgorithm by checking that there is exactly one Layout object. This guarantees correct rendering and prevents crashes.

Open in Gerrit

Related details

Attention is currently required from:
  • Frédéric Wang Nélar
  • Morten Stenshorne
  • Philip Rogers
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I4b2b6edb590d24d9bab5ce9a3a8eee4d9eab8768
Gerrit-Change-Number: 7614911
Gerrit-PatchSet: 5
Gerrit-Owner: THANK FLY <thiefun...@gmail.com>
Gerrit-Reviewer: Frédéric Wang Nélar <fw...@igalia.com>
Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
Gerrit-Reviewer: THANK FLY <thiefun...@gmail.com>
Gerrit-CC: Eri Pazos Pérez <e...@igalia.com>
Gerrit-CC: Ian Kilpatrick <ikilp...@chromium.org>
Gerrit-CC: Philip Rogers <p...@chromium.org>
Gerrit-Attention: Philip Rogers <p...@chromium.org>
Gerrit-Attention: Frédéric Wang Nélar <fw...@igalia.com>
Gerrit-Attention: Morten Stenshorne <mste...@chromium.org>
Gerrit-Comment-Date: Tue, 21 Apr 2026 04:31:29 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Frédéric Wang Nélar <fw...@igalia.com>
Comment-In-Reply-To: Morten Stenshorne <mste...@chromium.org>
satisfied_requirement
unsatisfied_requirement
open
diffy

THANK FLY (Gerrit)

unread,
Apr 21, 2026, 12:33:09 AM (yesterday) Apr 21
to Eri Pazos Pérez, android-bu...@system.gserviceaccount.com, Frédéric Wang Nélar, Ian Kilpatrick, Morten Stenshorne, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-revi...@chromium.org, blink-...@chromium.org, zol...@webkit.org
Attention needed from Frédéric Wang Nélar, Morten Stenshorne and Philip Rogers

THANK FLY added 1 comment

File third_party/blink/renderer/core/layout/mathml/math_layout_utils.cc
Line 242, Patchset 3: if (!block_flow || !block_flow->ChildrenInline()) {
Morten Stenshorne . resolved

Won't this be covered by the above `node.FirstChild().IsInline()` check?

THANK FLY

I have adjusted fix.

Open in Gerrit

Related details

Attention is currently required from:
  • Frédéric Wang Nélar
  • Morten Stenshorne
  • Philip Rogers
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I4b2b6edb590d24d9bab5ce9a3a8eee4d9eab8768
    Gerrit-Change-Number: 7614911
    Gerrit-PatchSet: 5
    Gerrit-Owner: THANK FLY <thiefun...@gmail.com>
    Gerrit-Reviewer: Frédéric Wang Nélar <fw...@igalia.com>
    Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
    Gerrit-Reviewer: THANK FLY <thiefun...@gmail.com>
    Gerrit-CC: Eri Pazos Pérez <e...@igalia.com>
    Gerrit-CC: Ian Kilpatrick <ikilp...@chromium.org>
    Gerrit-CC: Philip Rogers <p...@chromium.org>
    Gerrit-Attention: Philip Rogers <p...@chromium.org>
    Gerrit-Attention: Frédéric Wang Nélar <fw...@igalia.com>
    Gerrit-Attention: Morten Stenshorne <mste...@chromium.org>
    Gerrit-Comment-Date: Tue, 21 Apr 2026 04:32:34 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    Comment-In-Reply-To: Morten Stenshorne <mste...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Morten Stenshorne (Gerrit)

    unread,
    Apr 21, 2026, 3:39:59 AM (yesterday) Apr 21
    to THANK FLY, Eri Pazos Pérez, android-bu...@system.gserviceaccount.com, Frédéric Wang Nélar, Ian Kilpatrick, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-revi...@chromium.org, blink-...@chromium.org, zol...@webkit.org
    Attention needed from Frédéric Wang Nélar, Philip Rogers and THANK FLY

    Morten Stenshorne added 6 comments

    Patchset-level comments
    File-level comment, Patchset 5 (Latest):
    Morten Stenshorne . resolved

    Need help from the MathML folks, but I'm fairly convinced that this fix is wrong.

    Why should:

    ```
    <math>
    <mo style="width:1px;">a <!-- -->b</mo>
    </math>
    ```

    render differently from:

    ```
    <math>
    <mo style="width:1px;">a b</mo>
    </math>
    ```

    'b' is visible in the first example, but not in the second.

    Commit Message
    Line 21, Patchset 3:After the fix: renders "!→" without dcheck
    Morten Stenshorne . resolved

    This suggests that this is fixing a correctness issue. So how about a correctness test, and not just a crash test?

    THANK FLY

    Now add a mathml_operator_element_test.cc for correctness test.

    Morten Stenshorne

    Why not a web test? Is there no visual correctness issue here?

    File third_party/blink/renderer/core/mathml/mathml_operator_element_test.cc
    Line 16, Patchset 5 (Latest):namespace test {
    Morten Stenshorne . unresolved

    Should be anonymous.

    Line 28, Patchset 5 (Latest): const auto& token_content = element->GetTokenContent();
    Morten Stenshorne . unresolved

    Avoid auto, when the type isn't obvious, to make it more readable.

    Line 36, Patchset 5 (Latest): auto* layout_object = element->GetLayoutObject();
    Morten Stenshorne . unresolved

    You're assuming it's a LayoutBox further below. Should move the cast here.

    Line 39, Patchset 5 (Latest): ASSERT_TRUE(first_child);
    Morten Stenshorne . unresolved

    What about these children? Should they be examined? Why is it important to check that there are at least two children?

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Frédéric Wang Nélar
    • Philip Rogers
    • THANK FLY
    Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement is not satisfiedCode-Owners
      • requirement is not satisfiedCode-Review
      • requirement is not satisfiedNo-Unresolved-Comments
      • requirement is not satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I4b2b6edb590d24d9bab5ce9a3a8eee4d9eab8768
      Gerrit-Change-Number: 7614911
      Gerrit-PatchSet: 5
      Gerrit-Owner: THANK FLY <thiefun...@gmail.com>
      Gerrit-Reviewer: Frédéric Wang Nélar <fw...@igalia.com>
      Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
      Gerrit-Reviewer: THANK FLY <thiefun...@gmail.com>
      Gerrit-CC: Eri Pazos Pérez <e...@igalia.com>
      Gerrit-CC: Ian Kilpatrick <ikilp...@chromium.org>
      Gerrit-CC: Philip Rogers <p...@chromium.org>
      Gerrit-Attention: Philip Rogers <p...@chromium.org>
      Gerrit-Attention: Frédéric Wang Nélar <fw...@igalia.com>
      Gerrit-Attention: THANK FLY <thiefun...@gmail.com>
      Gerrit-Comment-Date: Tue, 21 Apr 2026 07:39:45 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: No
      Comment-In-Reply-To: Morten Stenshorne <mste...@chromium.org>
      Comment-In-Reply-To: THANK FLY <thiefun...@gmail.com>
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      THANK FLY (Gerrit)

      unread,
      Apr 21, 2026, 4:25:21 AM (yesterday) Apr 21
      to Eri Pazos Pérez, android-bu...@system.gserviceaccount.com, Frédéric Wang Nélar, Ian Kilpatrick, Morten Stenshorne, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-revi...@chromium.org, blink-...@chromium.org, zol...@webkit.org
      Attention needed from Frédéric Wang Nélar, Morten Stenshorne and Philip Rogers

      THANK FLY added 1 comment

      Commit Message
      Line 21, Patchset 3:After the fix: renders "!→" without dcheck
      Morten Stenshorne . resolved

      This suggests that this is fixing a correctness issue. So how about a correctness test, and not just a crash test?

      THANK FLY

      Now add a mathml_operator_element_test.cc for correctness test.

      Morten Stenshorne

      Why not a web test? Is there no visual correctness issue here?

      THANK FLY

      Thanks firstly. May I ask where the correct test should be placed? I'm actually not familiar with this test. third_party/blink/web_tests/external/wpt/mathml/crashtests/comment-and-entity-in-mo.html can be visually verified. Is this enough?

      Open in Gerrit

      Related details

      Attention is currently required from:
      • Frédéric Wang Nélar
      • Morten Stenshorne
      • Philip Rogers
      Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement is not satisfiedCode-Owners
      • requirement is not satisfiedCode-Review
      • requirement is not satisfiedNo-Unresolved-Comments
      • requirement is not satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I4b2b6edb590d24d9bab5ce9a3a8eee4d9eab8768
      Gerrit-Change-Number: 7614911
      Gerrit-PatchSet: 6
      Gerrit-Owner: THANK FLY <thiefun...@gmail.com>
      Gerrit-Reviewer: Frédéric Wang Nélar <fw...@igalia.com>
      Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
      Gerrit-Reviewer: THANK FLY <thiefun...@gmail.com>
      Gerrit-CC: Eri Pazos Pérez <e...@igalia.com>
      Gerrit-CC: Ian Kilpatrick <ikilp...@chromium.org>
      Gerrit-CC: Philip Rogers <p...@chromium.org>
      Gerrit-Attention: Philip Rogers <p...@chromium.org>
      Gerrit-Attention: Frédéric Wang Nélar <fw...@igalia.com>
      Gerrit-Attention: Morten Stenshorne <mste...@chromium.org>
      Gerrit-Comment-Date: Tue, 21 Apr 2026 08:24:51 +0000
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      THANK FLY (Gerrit)

      unread,
      Apr 21, 2026, 4:44:13 AM (yesterday) Apr 21
      to Eri Pazos Pérez, android-bu...@system.gserviceaccount.com, Frédéric Wang Nélar, Ian Kilpatrick, Morten Stenshorne, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-revi...@chromium.org, blink-...@chromium.org, zol...@webkit.org
      Attention needed from Frédéric Wang Nélar, Morten Stenshorne and Philip Rogers

      THANK FLY added 1 comment

      Patchset-level comments
      Morten Stenshorne . resolved

      Need help from the MathML folks, but I'm fairly convinced that this fix is wrong.

      Why should:

      ```
      <math>
      <mo style="width:1px;">a <!-- -->b</mo>
      </math>
      ```

      render differently from:

      ```
      <math>
      <mo style="width:1px;">a b</mo>
      </math>
      ```

      'b' is visible in the first example, but not in the second.

      THANK FLY

      Indeed, only a appears in the second example. This is because, in the logic I modified, the first case has two layout objects split by a comment, so it uses normal text layout and renders both text items.
      For the second case, I believe there is only one layout object, so it goes through MathTokenLayoutAlgorithm. This algorithm likely only supports a single character, so the trailing b does not get laid out or displayed.

      I'm not even sure how this case should be fixed at this point.I think the issue is probably with the MathTokenLayoutAlgorithm; it might not be able to enforce constraints properly.

      Gerrit-Comment-Date: Tue, 21 Apr 2026 08:43:42 +0000
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Morten Stenshorne (Gerrit)

      unread,
      Apr 21, 2026, 4:53:53 AM (yesterday) Apr 21
      to THANK FLY, Eri Pazos Pérez, android-bu...@system.gserviceaccount.com, Frédéric Wang Nélar, Ian Kilpatrick, Philip Rogers, Chromium LUCI CQ, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-revi...@chromium.org, blink-...@chromium.org, zol...@webkit.org
      Attention needed from Frédéric Wang Nélar, Philip Rogers and THANK FLY

      Morten Stenshorne added 2 comments

      Patchset-level comments
      File-level comment, Patchset 5:
      Morten Stenshorne . unresolved

      Need help from the MathML folks, but I'm fairly convinced that this fix is wrong.

      Why should:

      ```
      <math>
      <mo style="width:1px;">a <!-- -->b</mo>
      </math>
      ```

      render differently from:

      ```
      <math>
      <mo style="width:1px;">a b</mo>
      </math>
      ```

      'b' is visible in the first example, but not in the second.

      THANK FLY

      Indeed, only a appears in the second example. This is because, in the logic I modified, the first case has two layout objects split by a comment, so it uses normal text layout and renders both text items.
      For the second case, I believe there is only one layout object, so it goes through MathTokenLayoutAlgorithm. This algorithm likely only supports a single character, so the trailing b does not get laid out or displayed.

      I'm not even sure how this case should be fixed at this point.I think the issue is probably with the MathTokenLayoutAlgorithm; it might not be able to enforce constraints properly.

      Morten Stenshorne

      My point is that an HTML comment should typically never affect rendering. But now it does.

      Commit Message
      Line 21, Patchset 3:After the fix: renders "!→" without dcheck
      Morten Stenshorne . unresolved

      This suggests that this is fixing a correctness issue. So how about a correctness test, and not just a crash test?

      THANK FLY

      Now add a mathml_operator_element_test.cc for correctness test.

      Morten Stenshorne

      Why not a web test? Is there no visual correctness issue here?

      THANK FLY

      Thanks firstly. May I ask where the correct test should be placed? I'm actually not familiar with this test. third_party/blink/web_tests/external/wpt/mathml/crashtests/comment-and-entity-in-mo.html can be visually verified. Is this enough?

      Morten Stenshorne

      That's a crash test. We typically need a reftest or something using testharness, probably in third_party/blink/web_tests/external/wpt/mathml/ . Keeping the existing crash test is fine.

      Documentation here: https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/testing/web_platform_tests.md

      Open in Gerrit

      Related details

      Attention is currently required from:
      • Frédéric Wang Nélar
      • Philip Rogers
      • THANK FLY
      Gerrit-Attention: THANK FLY <thiefun...@gmail.com>
      Gerrit-Comment-Date: Tue, 21 Apr 2026 08:53:40 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: No
      Comment-In-Reply-To: Morten Stenshorne <mste...@chromium.org>
      Comment-In-Reply-To: THANK FLY <thiefun...@gmail.com>
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy
      Reply all
      Reply to author
      Forward
      0 new messages