Restrict the types of nodes that could be assigned to a slot.

third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/shadow/SlotAssignment.h"
 
 #include "core/HTMLNames.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/shadow/InsertionPoint.h"
@@ skipping 47 matching lines @@
                     assign(child, *defaultSlot);
                 else
                     detachNotAssignedNode(child);
             } else {
                 HTMLSlotElement* slot = name2slot.get(slotName);
                 if (slot)
                     assign(child, *slot);
                 else
                     detachNotAssignedNode(child);
             }
-        } else if (defaultSlot) {
+        } else if (defaultSlot && child.isTextNode()) {
             assign(child, *defaultSlot);
         } else {
             detachNotAssignedNode(child);
         }
     }
 
     // Update each slot's distribution in reverse tree order so that a child slot is visited before its parent slot.
     for (auto slot = slots.rbegin(); slot != slots.rend(); ++slot)
         (*slot)->updateDistributedNodesWithFallback();
 }
 
 void SlotAssignment::assign(Node& hostChild, HTMLSlotElement& slot)
 {
+    ASSERT(hostChild.isSlotAssignable());
     m_assignment.add(&hostChild, &slot);
     slot.appendAssignedNode(hostChild);
     if (isHTMLSlotElement(hostChild))
         slot.appendDistributedNodesFrom(toHTMLSlotElement(hostChild));
     else
         slot.appendDistributedNode(hostChild);
 }
 
 DEFINE_TRACE(SlotAssignment)
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_assignment);
 #endif
 }
 
 } // namespace blink