Prevent mis-nested fullscreen in iframes

Source/core/dom/Fullscreen.cpp

Index: Source/core/dom/Fullscreen.cpp
diff --git a/Source/core/dom/Fullscreen.cpp b/Source/core/dom/Fullscreen.cpp
index d1cfb30e5c0143408173fd07fae28b4dd1dc14c2..2230019b917137d24952a58edc8053145696253b 100644
--- a/Source/core/dom/Fullscreen.cpp
+++ b/Source/core/dom/Fullscreen.cpp
@@ -185,9 +185,9 @@ bool Fullscreen::elementReady(Element& element, RequestType requestType)
     }
 
     // |element|'s node document's fullscreen element stack is either empty or its top element is an
-    // ancestor of |element|.
+    // inclusive ancestor of |element|.
     if (Element* topElement = fullscreenElementFrom(element.document())) {
-        if (!element.isDescendantOf(topElement))
+        if (!topElement->contains(&element))
             return false;
     }
 
@@ -196,6 +196,14 @@ bool Fullscreen::elementReady(Element& element, RequestType requestType)
     if (Traversal<HTMLIFrameElement>::firstAncestor(element))
         return false;
 
+    // |element|'s node document's browsing context either has a browsing context container and the
+    // fullscreen element ready check returns true for |element|'s node document's browsing
+    // context's browsing context container, or it has no browsing context container.
+    if (HTMLFrameOwnerElement* container = element.document().ownerElement()) {
+        if (!elementReady(*container, requestType))
+            return false;
+    }
+
     return true;
 }