Only allow UA widgets as children of media elements

Do not allow pseudo-elements for replaced elements

1 files changed, 8 insertions, 3 deletions

diff --git a/components/layout/construct.rs b/components/layout/construct.rs
index f108876d53c..38c2c9f4f1e 100644
--- a/components/layout/construct.rs
+++ b/components/layout/construct.rs
@@ -705,11 +705,16 @@ impl<'a, ConcreteThreadSafeLayoutNode: ThreadSafeLayoutNode>
         // List of absolute descendants, in tree order.
         let mut abs_descendants = AbsoluteDescendants::new();
         let mut legalizer = Legalizer::new();
-        if !node.is_replaced_content() ||
-            node.type_id() == Some(LayoutNodeType::Element(LayoutElementType::HTMLMediaElement))
-        {
+        let is_media_element_with_widget = node.type_id() ==
+            Some(LayoutNodeType::Element(LayoutElementType::HTMLMediaElement)) &&
+            node.as_element().unwrap().is_shadow_host();
+        if !node.is_replaced_content() || is_media_element_with_widget {
             for kid in node.children() {
                 if kid.get_pseudo_element_type() != PseudoElementType::Normal {
+                    if node.is_replaced_content() {
+                        // Replaced elements don't have pseudo-elements per spec.
+                        continue;
+                    }
                     self.process(&kid);
                 }