In bug 1583037, I intend to remove special layout of invalid MathML markup as an "invalid-markup" text. Chromium implements the fallback from MathML Core. WebKit just lays out an empty box but there is a bug to change that (webkit.org/b/123348123348
Bug to remove: https://bugzilla.mozilla.org/show_bug.cgi?id=1583037
Rationale: This is typically happening for MathML elements that don't have the expected number of children e.g. a fraction that don't have exactly two children (numerator and denominator), meaning a document that must be fixed by the author or a temporary state (tree constructed via DOM operations). Gecko currently does not layout the subtree and displays an "invalid-markup" message instead. The goal is to align with MathML Core, which says to fallback to laying out all the children in a row instead. As a side consequence, Gecko will now layout the subtree of invalid MathML markup generated by fuzzers or testcase reducers, which can make these more efficient.
Developer console: Gecko will continue to log the markup error in the developer console, which is a more appropriate place and allows more descriptive message.
Telemetry analysis: N/A ; invalid MathML markup is likely to happen in web pages and we need to decide how to render it anyway.