Fully update the state even on invalid markups to avoid crashing, b=307839, r+sr=bz

layout/mathml/base/src/nsMathMLContainerFrame.cpp

@@ -525,7 +525,7 @@ nsMathMLContainerFrame::PropagatePresentationDataFor(nsIFrame*       aFrame,
                                                      PRUint32        aFlagsValues,
                                                      PRUint32        aFlagsToUpdate)
 {
-  if (!aFlagsToUpdate && !aScriptLevelIncrement)
+  if (!aFrame || (!aFlagsToUpdate && !aScriptLevelIncrement))
     return;
   nsIMathMLFrame* mathMLFrame;
   aFrame->QueryInterface(NS_GET_IID(nsIMathMLFrame), (void**)&mathMLFrame);
@@ -557,7 +557,7 @@ nsMathMLContainerFrame::PropagatePresentationDataFromChildAt(nsIFrame*       aPa
                                                              PRUint32        aFlagsValues,
                                                              PRUint32        aFlagsToUpdate)
 {
-  if (!aFlagsToUpdate && !aScriptLevelIncrement)
+  if (!aParentFrame || (!aFlagsToUpdate && !aScriptLevelIncrement))
     return;
   PRInt32 index = 0;
   nsIFrame* childFrame = aParentFrame->GetFirstChild(nsnull);
@@ -582,6 +582,8 @@ nsMathMLContainerFrame::PropagatePresentationDataFromChildAt(nsIFrame*       aPa
 nsMathMLContainerFrame::PropagateScriptStyleFor(nsIFrame*       aFrame,
                                                 PRInt32         aParentScriptLevel)
 {
+  if (!aFrame)
+    return;
   nsIMathMLFrame* mathMLFrame;
   aFrame->QueryInterface(NS_GET_IID(nsIMathMLFrame), (void**)&mathMLFrame);
   if (mathMLFrame) {

layout/mathml/base/src/nsMathMLmoverFrame.cpp

@@ -189,8 +189,6 @@ XXX The winner is the outermost in conflicting settings like these:
   nsIFrame* baseFrame = mFrames.FirstChild();
   if (baseFrame)
     overscriptFrame = baseFrame->GetNextSibling();
-  if (!baseFrame || !overscriptFrame)
-    return NS_OK; // a visual error indicator will be reported later during layout
 
   // if our base is an embellished operator, let its state bubble to us (in particular,
   // this is where we get the flag for NS_MATHML_EMBELLISH_MOVABLELIMITS). Our flags

layout/mathml/base/src/nsMathMLmunderFrame.cpp

@@ -189,8 +189,6 @@ XXX The winner is the outermost setting in conflicting settings like these:
   nsIFrame* baseFrame = mFrames.FirstChild();
   if (baseFrame)
     underscriptFrame = baseFrame->GetNextSibling();
-  if (!baseFrame || !underscriptFrame)
-    return NS_OK; // a visual error indicator will be reported later during layout
 
   // if our base is an embellished operator, let its state bubble to us (in particular,
   // this is where we get the flag for NS_MATHML_EMBELLISH_MOVABLELIMITS). Our flags

layout/mathml/base/src/nsMathMLmunderoverFrame.cpp

@@ -193,8 +193,6 @@ nsMathMLmunderoverFrame::TransmitAutomaticData()
     underscriptFrame = baseFrame->GetNextSibling();
   if (underscriptFrame)
     overscriptFrame = underscriptFrame->GetNextSibling();
-  if (!baseFrame || !underscriptFrame || !overscriptFrame)
-    return NS_OK; // a visual error indicator will be reported later during layout
 
   // if our base is an embellished operator, let its state bubble to us (in particular,
   // this is where we get the flag for NS_MATHML_EMBELLISH_MOVABLELIMITS). Our flags