Merge 122432 - [Shadow DOM] <video> with <shadow> crashes

Merge 122432 - [Shadow DOM] <video> with <shadow> crashes
https://bugs.webkit.org/show_bug.cgi?id=91055

Reviewed by Kent Tamura.

Source/WebCore:

This is similar to Bug 90480, where an undesired renderer is created by
locating an insertion point on the shadow boundary.

This change adds a guard for such case by cheking whether the
source node of each to-be-created renderer comes from the UA shadow
tree, which is allowed to have a renderer.

Test: fast/dom/shadow/insertion-point-video-crash.html

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::childShouldCreateRenderer): Added a check.
(WebCore::HTMLMediaElement::mediaControls): Added const.
(WebCore::HTMLMediaElement::hasMediaControls): Added const.
* html/HTMLMediaElement.h:
(HTMLMediaElement):

LayoutTests:

* fast/dom/shadow/insertion-point-video-crash-expected.txt: Added.
* fast/dom/shadow/insertion-point-video-crash.html: Added.


TBR=morrita@google.com
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=122538