Support slot element's fallback content feature

third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp

Index: third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
diff --git a/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp b/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
index 9699e4a8a28663b33d4f21690f03f68ae6568e75..34c9f5abb695912b00259e4c94fa0bc5a4a6effe 100644
--- a/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
+++ b/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
@@ -31,11 +31,14 @@ void SlotAssignment::resolveAssignment(const ShadowRoot& shadowRoot)
     using Name2Slot = HashMap<AtomicString, HTMLSlotElement*>;
     Name2Slot name2slot;
     HTMLSlotElement* defaultSlot = nullptr;
+    Vector<HTMLSlotElement*> slots;
 
     // TODO(hayato): Cache slots elements so that we do not have to travese the shadow tree. See ShadowRoot::descendantInsertionPoints()
     for (HTMLSlotElement& slot : Traversal<HTMLSlotElement>::descendantsOf(shadowRoot)) {
         slot.clearDistribution();
 
+        slots.append(&slot);
+
         AtomicString name = slot.fastGetAttribute(HTMLNames::nameAttr);
         if (name.isNull() || name.isEmpty()) {
             if (!defaultSlot)
@@ -71,6 +74,10 @@ void SlotAssignment::resolveAssignment(const ShadowRoot& shadowRoot)
             detachNotAssignedNode(child);
         }
     }
+
+    // Update each slot's distribution in reverse tree order so that a child slot is visited before its parent slot.
+    for (auto slot = slots.rbegin(); slot != slots.rend(); ++slot)
+        (*slot)->updateDistributedNodesWithFallback();
 }
 
 void SlotAssignment::assign(Node& hostChild, HTMLSlotElement& slot)