Restrict the types of nodes that could be assigned to a slot.

third_party/WebKit/Source/core/html/HTMLSlotElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp b/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
index 1ecda59fd63da0330250352820bc4b5ac0d3c2de..e6e061fd43441c0744f6756e3e144a599401666e 100644
--- a/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
@@ -68,6 +68,8 @@ const WillBeHeapVector<RefPtrWillBeMember<Node>>& HTMLSlotElement::getDistribute
     // update the distribution code so it considers a document tree too.
     clearDistribution();
     for (Node& child : NodeTraversal::childrenOf(*this)) {
+        if (!child.isSlotAssignable())
+            continue;
         if (isHTMLSlotElement(child))
             m_distributedNodes.appendVector(toHTMLSlotElement(child).getDistributedNodes());
         else
@@ -204,6 +206,8 @@ void HTMLSlotElement::updateDistributedNodesWithFallback()
     if (!m_distributedNodes.isEmpty())
         return;
     for (auto& child : NodeTraversal::childrenOf(*this)) {
+        if (!child.isSlotAssignable())
+            continue;
         // Insertion points are not supported as slots fallback
         if (isActiveInsertionPoint(child))
             continue;