From discussion on bug 50126, Niwa-san suggested a pretty nifty idea: what if we re-describe all elements that currently rely on RenderReplaced for rendering as elements with a shadow DOM (created by UA), that looks like this--taken from Ryosuke's comment:
HTMLCanvasElement -> ShadowRoot -> some-special-element/renderer, inaccessible from ES5
fallback contents (accessible from DOM, focus, etc... would just work when shown)
This would solve nicely the fallback content issues with focus and possibly allow us to replace RenderReplaced with a better-defined shadow DOM logic.
Also, this dovetails pretty well into https://www.w3.org/Bugs/Public/show_bug.cgi?id=15802.
One drawback of this approach is that we'll double or triple the number of nodes for replaced elements depending on how we implement them. So we might want to add some clever memory-saving mechanism along the way.