https://bugs.webkit.org/show_bug.cgi?id=91055

Reviewed by Kent Tamura.

Source/WebCore:

This is similar to Bug 90480, where an undesired renderer is created by
locating an insertion point on the shadow boundary.

This change adds a guard for such case by cheking whether the
source node of each to-be-created renderer comes from the UA shadow
tree, which is allowed to have a renderer.

Test: fast/dom/shadow/insertion-point-video-crash.html

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::childShouldCreateRenderer): Added a check.
(WebCore::HTMLMediaElement::mediaControls): Added const.
(WebCore::HTMLMediaElement::hasMediaControls): Added const.
* html/HTMLMediaElement.h:
(HTMLMediaElement):

LayoutTests:

* fast/dom/shadow/insertion-point-video-crash-expected.txt: Added.
* fast/dom/shadow/insertion-point-video-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122432 268f45cc-cd09-0410-ab3c-d52691b4dbfc