Created attachment 51489 [details] An example of MathML of <mfrac> and <msubsup> In my attachment example, I combine <mfrac> and <msubsup> to use, but the layout is incorrect. Please see attached xhtml for references. And the correct layout should be same as attached png.
Created attachment 51490 [details] Correct layout of the xhtml.
The problem does not come from the mfrac element, but from the mrow in which the msubsup is embedded. See the attachment.
Created attachment 52497 [details] Test showing the bug when msubsup is embedded in an mrow element.
Actually, math and mrow are almost the exact same rendering object (RenderMathMLRow). The cause of this is a row containing another row and stretching. The row operator stretching algorithm is doing something strange to the layout of msubsup in this context. The new layout patch in https://bugs.webkit.org/show_bug.cgi?id=40986 doesn't fix this yet.
Created attachment 60058 [details] Patch fixing the bug
Comment on attachment 60058 [details] Patch fixing the bug > + if (base->firstChild()->isRenderMathMLBlock()) { What guarantees that base->firstChild() is non-null? Otherwise, this patch looks good to me.
Created attachment 60064 [details] Updated patch I added a test to be sure that base->firstChild() exists. However, lines 100 and 101 of RenderMathMLSubSup.cpp should guarantee it.
(In reply to comment #7) > I added a test to be sure that base->firstChild() exists. > > However, lines 100 and 101 of RenderMathMLSubSup.cpp should guarantee it. We don't need both a test and a guarantee! Only one or the other.
Comment on attachment 60064 [details] Updated patch Revert to previous patch to avoid unnecessary test.
Comment on attachment 60058 [details] Patch fixing the bug Clearing flags on attachment: 60058 Committed r62152: <http://trac.webkit.org/changeset/62152>
All reviewed patches have been landed. Closing bug.