Prevent mis-nested fullscreen in iframes

Source/core/dom/Fullscreen.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
@@ skipping 167 matching lines @@
 
     // |element|'s node document's fullscreen enabled flag is set.
     if (!fullscreenIsAllowedForAllOwners(element.document())) {
         if (requestType == PrefixedVideoRequest)
             UseCounter::count(element.document(), UseCounter::VideoFullscreenAllowedExemption);
         else
             return false;
     }
 
     // |element|'s node document's fullscreen element stack is either empty or its top element is an
-    // ancestor of |element|.
+    // inclusive ancestor of |element|.
     if (Element* topElement = fullscreenElementFrom(element.document())) {
-        if (!element.isDescendantOf(topElement))
+        if (!topElement->contains(&element))
             return false;
     }
 
     // |element| has no ancestor element whose local name is iframe and namespace is the HTML
     // namespace.
     if (Traversal<HTMLIFrameElement>::firstAncestor(element))
         return false;
 
+    // |element|'s node document's browsing context either has a browsing context container and the
+    // fullscreen element ready check returns true for |element|'s node document's browsing
+    // context's browsing context container, or it has no browsing context container.
+    if (HTMLFrameOwnerElement* container = element.document().ownerElement()) {
+        if (!elementReady(*container, requestType))
+            return false;
+    }
+
     return true;
 }
 
 void Fullscreen::requestFullscreen(Element& element, RequestType requestType)
 {
     // Ignore this request if the document is not in a live frame.
     if (!document()->isActive())
         return;
 
     // If |element| is on top of |doc|'s fullscreen element stack, terminate these substeps.
@@ skipping 393 matching lines @@
 void Fullscreen::trace(Visitor* visitor)
 {
     visitor->trace(m_fullScreenElement);
     visitor->trace(m_fullScreenElementStack);
     visitor->trace(m_fullScreenRenderer);
     visitor->trace(m_eventQueue);
     DocumentSupplement::trace(visitor);
 }
 
 } // namespace blink