Support slot element's fallback content feature

third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp

Index: third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
diff --git a/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp b/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
index 6c791be04e33e81dadf9e2aef9daf3cd07409966..4d8530a49091c696a509809077724d5f29c9b86f 100644
--- a/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
+++ b/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
@@ -32,11 +32,14 @@ void SlotAssignment::resolveAssignment(const ShadowRoot& shadowRoot)
     using Name2Slot = HashMap<AtomicString, HTMLSlotElement*>;
     Name2Slot name2slot;
     HTMLSlotElement* defaultSlot = nullptr;
+    Vector<HTMLSlotElement*> slots;
 
     // TODO(hayato): Cache slots elements so that we do not have to travese the shadow tree. See ShadowRoot::descendantInsertionPoints()
     for (HTMLSlotElement& slot : Traversal<HTMLSlotElement>::descendantsOf(shadowRoot)) {
         slot.clearDistribution();
 
+        slots.append(&slot);
+
         AtomicString name = slot.fastGetAttribute(HTMLNames::nameAttr);
         if (name.isNull() || name.isEmpty()) {
             if (!defaultSlot)
@@ -72,6 +75,10 @@ void SlotAssignment::resolveAssignment(const ShadowRoot& shadowRoot)
             detachNotAssignedNode(child);
         }
     }
+
+    // Update each slot's distribution in reverse tree order so that a child slot is visited before its parent slot.
+    for (auto slot = slots.rbegin(); slot != slots.rend(); ++slot)
+        (*slot)->updateDistributedNodesWithFallback();
 }
 
 void SlotAssignment::assign(Node& hostChild, HTMLSlotElement& slot)