Merge 122432 - [Shadow DOM] <video> with <shadow> crashes

Source/WebCore/html/HTMLMediaElement.cpp

Index: Source/WebCore/html/HTMLMediaElement.cpp
===================================================================
--- Source/WebCore/html/HTMLMediaElement.cpp	(revision 122537)
+++ Source/WebCore/html/HTMLMediaElement.cpp	(working copy)
@@ -488,7 +488,11 @@
 
 bool HTMLMediaElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    return childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
+    if (!hasMediaControls())
+        return false;
+    // Only allows nodes from the controls shadow subtree.
+    return (mediaControls()->treeScope() == childContext.node()->treeScope()
+            && childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext));
 }
 
 Node::InsertionNotificationRequest HTMLMediaElement::insertedInto(ContainerNode* insertionPoint)
@@ -4144,12 +4148,12 @@
     m_player->setPrivateBrowsingMode(privateMode);
 }
 
-MediaControls* HTMLMediaElement::mediaControls()
+MediaControls* HTMLMediaElement::mediaControls() const
 {
     return toMediaControls(shadow()->oldestShadowRoot()->firstChild());
 }
 
-bool HTMLMediaElement::hasMediaControls()
+bool HTMLMediaElement::hasMediaControls() const
 {
     ElementShadow* elementShadow = shadow();
     if (!elementShadow)