Restrict the types of nodes that could be assigned to a slot.

third_party/WebKit/Source/core/html/HTMLSlotElement.cpp

 /*
  * Copyright (C) 2015 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 50 matching lines @@
     if (isInShadowTree())
         return m_distributedNodes;
 
     // A slot is unlikely to be used outside of a shadow tree.
     // We do not need to optimize this case in most cases.
     // TODO(hayato): If this path causes a performance issue, we should move
     // ShadowRootRaraDate::m_descendantSlots into TreeScopreRareData-ish and
     // update the distribution code so it considers a document tree too.
     clearDistribution();
     for (Node& child : NodeTraversal::childrenOf(*this)) {
+        if (!child.isSlotAssignable())
+            continue;
         if (isHTMLSlotElement(child))
             m_distributedNodes.appendVector(toHTMLSlotElement(child).getDistributedNodes());
         else
             m_distributedNodes.append(&child);
     }
     return m_distributedNodes;
 }
 
 void HTMLSlotElement::appendAssignedNode(Node& node)
 {
@@ skipping 116 matching lines @@
         root->didRemoveSlot();
 
     HTMLElement::removedFrom(insertionPoint);
 }
 
 void HTMLSlotElement::updateDistributedNodesWithFallback()
 {
     if (!m_distributedNodes.isEmpty())
         return;
     for (auto& child : NodeTraversal::childrenOf(*this)) {
+        if (!child.isSlotAssignable())
+            continue;
         // Insertion points are not supported as slots fallback
         if (isActiveInsertionPoint(child))
             continue;
         if (isHTMLSlotElement(child))
             appendDistributedNodesFrom(toHTMLSlotElement(child));
         else
             appendDistributedNode(child);
     }
 }
 
 DEFINE_TRACE(HTMLSlotElement)
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_assignedNodes);
     visitor->trace(m_distributedNodes);
     visitor->trace(m_distributedIndices);
 #endif
     HTMLElement::trace(visitor);
 }
 
 } // namespace blink