Convert SVG <foreignObject> to use RenderObject::isChildAllowed

Source/core/rendering/svg/RenderSVGForeignObject.cpp

Index: Source/core/rendering/svg/RenderSVGForeignObject.cpp
diff --git a/Source/core/rendering/svg/RenderSVGForeignObject.cpp b/Source/core/rendering/svg/RenderSVGForeignObject.cpp
index ef56fcab986f43a295b48e98c13f7abf4c9ec173..898fb05a371587b54c951bdcfd92ed599193b025 100644
--- a/Source/core/rendering/svg/RenderSVGForeignObject.cpp
+++ b/Source/core/rendering/svg/RenderSVGForeignObject.cpp
@@ -45,6 +45,12 @@ RenderSVGForeignObject::~RenderSVGForeignObject()
 {
 }
 
+bool RenderSVGForeignObject::isChildAllowed(RenderObject* child, RenderStyle* style) const
+{
+    // Disallow arbitary SVG content. Only allow proper <svg xmlns="svgNS"> subdocuments.
+    return !child->isSVG() || child->isSVGRoot();
+}
+
 void RenderSVGForeignObject::paint(PaintInfo& paintInfo, const LayoutPoint&)
 {
     if (paintInfo.context->paintingDisabled()