Restrict the types of nodes that could be assigned to a slot.

third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp

Index: third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
diff --git a/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp b/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
index 982401aa49c5829c87718f7c393d5e1b8254ffde..6ee8312c6e27b0a1ac53b8d98a7d51a2eb5a4222 100644
--- a/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
+++ b/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
@@ -65,7 +65,7 @@ void SlotAssignment::resolveAssignment(ShadowRoot& shadowRoot)
                 else
                     detachNotAssignedNode(child);
             }
-        } else if (defaultSlot) {
+        } else if (defaultSlot && child.isTextNode()) {
             assign(child, *defaultSlot);
         } else {
             detachNotAssignedNode(child);
@@ -79,6 +79,7 @@ void SlotAssignment::resolveAssignment(ShadowRoot& shadowRoot)
 
 void SlotAssignment::assign(Node& hostChild, HTMLSlotElement& slot)
 {
+    ASSERT(hostChild.isSlotAssignable());
     m_assignment.add(&hostChild, &slot);
     slot.appendAssignedNode(hostChild);
     if (isHTMLSlotElement(hostChild))