Intent to unship: "invalid-markup" error message for invalid MathML markup

[Frédéric Wang]

In bug 1583037, I intend to remove special layout of invalid MathML
markup as an "invalid-markup" text. Chromium implements the fallback
from MathML Core. WebKit just lays out an empty box but there is a bug
to change that (webkit.org/b/123348123348).

Bug to remove: https://bugzilla.mozilla.org/show_bug.cgi?id=1583037

Rationale: This is typically happening for MathML elements that don't
have the expected number of children e.g. a fraction that don't have
exactly two children (numerator and denominator), meaning a document
that must be fixed by the author or a temporary state (tree constructed
via DOM operations). Gecko currently does not layout the subtree and
displays an "invalid-markup" message instead. The goal is to align with
MathML Core, which says to fallback to laying out all the children in a
row instead. As a side consequence, Gecko will now layout the subtree of
invalid MathML markup generated by fuzzers or testcase reducers, which
can make these more efficient.

Developer console: Gecko will continue to log the markup error in the
developer console, which is a more appropriate place and allows more
descriptive message.

Telemetry analysis: N/A ; invalid MathML markup is likely to happen in
web pages and we need to decide how to render it anyway.

--
Frédéric Wang