Don't allow out-of-flow positioned and floating children under LayoutMedia

third_party/WebKit/Source/core/layout/LayoutMedia.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 94 matching lines @@
         m_lastReportedPanelWidth.value() != newPanelWidth.value()) {
       mediaElement()->mediaControls()->notifyPanelWidthChanged(
           newPanelWidth.value());
       // Store the last value we reported, so we know if it has changed.
       m_lastReportedPanelWidth = newPanelWidth.value();
     }
   }
 }
 
 bool LayoutMedia::isChildAllowed(LayoutObject* child,
-                                 const ComputedStyle&) const {
+                                 const ComputedStyle& style) const {
   // Two types of child layout objects are allowed: media controls
   // and the text track container. Filter children by node type.
   ASSERT(child->node());
 
+  // Out-of-flow positioned or floating child breaks layout hierarchy.
+  // This check can be removed if ::-webkit-media-controls is made internal.
+  if (style.hasOutOfFlowPosition() || style.isFloating())
+    return false;
+
   // The user agent stylesheet (mediaControls.css) has
   // ::-webkit-media-controls { display: flex; }. If author style
   // sets display: inline we would get an inline layoutObject as a child
   // of replaced content, which is not supposed to be possible. This
   // check can be removed if ::-webkit-media-controls is made
   // internal.
   if (child->node()->isMediaControls())
     return child->isFlexibleBox();
 
   if (child->node()->isTextTrackContainer())
@@ skipping 34 matching lines @@
           .x());
   const LayoutUnit newWidth = visibleWidth - absoluteXOffset;
 
   if (newWidth < 0)
     return mediaRect.width();
 
   return std::min(mediaRect.width(), visibleWidth - absoluteXOffset);
 }
 
 }  // namespace blink