Do not use LayoutProgress for a UA shadow element of a PROGRESS element.

third_party/WebKit/Source/core/html/HTMLProgressElement.cpp

 /*
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 49 matching lines @@
 {
     if (!style.hasAppearance() || openShadowRoot())
         return LayoutObject::createObject(this, style);
     return new LayoutProgress(this);
 }
 
 LayoutProgress* HTMLProgressElement::layoutProgress() const
 {
     if (layoutObject() && layoutObject()->isProgress())
         return toLayoutProgress(layoutObject());
-
-    LayoutObject* layoutObject = userAgentShadowRoot()->firstChild()->layoutObject();
-    ASSERT_WITH_SECURITY_IMPLICATION(!layoutObject || layoutObject->isProgress());
-    return toLayoutProgress(layoutObject);
+    return nullptr;
 }
 
 void HTMLProgressElement::parseAttribute(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& value)
 {
     if (name == valueAttr) {
         if (oldValue.isNull() != value.isNull())
             pseudoStateChanged(CSSSelector::PseudoIndeterminate);
         didElementStateChange();
     } else if (name == maxAttr) {
         didElementStateChange();
@@ skipping 83 matching lines @@
     return !isDeterminate();
 }
 
 DEFINE_TRACE(HTMLProgressElement)
 {
     visitor->trace(m_value);
     LabelableElement::trace(visitor);
 }
 
 } // namespace blink