Disallow non-flexbox child renderers for RenderMedia

Source/core/rendering/RenderMedia.cpp

Index: Source/core/rendering/RenderMedia.cpp
diff --git a/Source/core/rendering/RenderMedia.cpp b/Source/core/rendering/RenderMedia.cpp
index 08994661a9b5a82362dc2eb6190a23eae6250b35..9be96225cded5b44e413657fd4a37d8fe58c7c1e 100644
--- a/Source/core/rendering/RenderMedia.cpp
+++ b/Source/core/rendering/RenderMedia.cpp
@@ -77,6 +77,16 @@ void RenderMedia::layout()
     clearNeedsLayout();
 }
 
+bool RenderMedia::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    // The only allowed child is the media controls. The user agent stylesheet
+    // (mediaControls.css) has ::-webkit-media-controls { display: flex; }. If
+    // author style sets display: inline we would get an inline renderer as a
+    // child of replaced content, which is not supposed to be possible. This
+    // check can be removed if ::-webkit-media-controls is made internal.
+    return child->isFlexibleBox();
+}
+
 void RenderMedia::paintReplaced(PaintInfo&, const LayoutPoint&)
 {
 }