Merge 184652 "Disallow non-flexbox child renderers for RenderMedia"

Source/core/rendering/RenderMedia.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 59 matching lines @@
 
     LayoutState state(*this, locationOffset());
 
     controlsRenderer->setLocation(LayoutPoint(borderLeft(), borderTop()) + LayoutSize(paddingLeft(), paddingTop()));
     controlsRenderer->style()->setHeight(Length(newSize.height(), Fixed));
     controlsRenderer->style()->setWidth(Length(newSize.width(), Fixed));
     controlsRenderer->forceLayout();
     clearNeedsLayout();
 }
 
+bool RenderMedia::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    // The only allowed child is the media controls. The user agent stylesheet
+    // (mediaControls.css) has ::-webkit-media-controls { display: flex; }. If
+    // author style sets display: inline we would get an inline renderer as a
+    // child of replaced content, which is not supposed to be possible. This
+    // check can be removed if ::-webkit-media-controls is made internal.
+    return child->isFlexibleBox();
+}
+
 void RenderMedia::paintReplaced(PaintInfo&, const LayoutPoint&)
 {
 }
 
 } // namespace blink