Don't allow out-of-flow positioned and floating children under LayoutMedia

third_party/WebKit/Source/core/layout/LayoutMedia.cpp

Index: third_party/WebKit/Source/core/layout/LayoutMedia.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutMedia.cpp b/third_party/WebKit/Source/core/layout/LayoutMedia.cpp
index 0c884a8794529ef2ba18d6d7b22becc18f7018d8..ae50013ff9ecb3b817429f21eccb38bf6018c019 100644
--- a/third_party/WebKit/Source/core/layout/LayoutMedia.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutMedia.cpp
@@ -112,11 +112,16 @@ void LayoutMedia::layout() {
 }
 
 bool LayoutMedia::isChildAllowed(LayoutObject* child,
-                                 const ComputedStyle&) const {
+                                 const ComputedStyle& style) const {
   // Two types of child layout objects are allowed: media controls
   // and the text track container. Filter children by node type.
   ASSERT(child->node());
 
+  // Out-of-flow positioned or floating child breaks layout hierarchy.
+  // This check can be removed if ::-webkit-media-controls is made internal.
+  if (style.hasOutOfFlowPosition() || style.isFloating())
+    return false;
+
   // The user agent stylesheet (mediaControls.css) has
   // ::-webkit-media-controls { display: flex; }. If author style
   // sets display: inline we would get an inline layoutObject as a child