Fix a crash caused by changing dir attribute of a slot element

third_party/WebKit/Source/core/html/HTMLElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004-2008, 2013, 2014 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 759 matching lines @@
 
 bool HTMLElement::selfOrAncestorHasDirAutoAttribute() const
 {
     return layoutObject() && layoutObject()->style() && layoutObject()->style()->selfOrAncestorHasDirAutoAttribute();
 }
 
 void HTMLElement::dirAttributeChanged(const AtomicString& value)
 {
     // If an ancestor has dir=auto, and this node has the first character,
     // changes to dir attribute may affect the ancestor.
+    if (!canParticipateInFlatTree())
+        return;

[kochi, 2016/07/22 07:41:33]

nit: The comment above and these 2 lines are not related, maybe swap
778-779 and 780-781?

[hayato, 2016/07/22 09:59:36]

Ah. Thanks, but I did not think so. I thought that this comment is applied to
all of this function.
Let me leave this as is.

     updateDistribution();
     Element* parent = FlatTreeTraversal::parentElement(*this);
     if (parent && parent->isHTMLElement() && toHTMLElement(parent)->selfOrAncestorHasDirAutoAttribute())
         toHTMLElement(parent)->adjustDirectionalityIfNeededAfterChildAttributeChanged(this);
 
     if (equalIgnoringCase(value, "auto"))
         calculateAndAdjustDirectionality();
 }
 
 void HTMLElement::adjustDirectionalityIfNeededAfterChildAttributeChanged(Element* child)
@@ skipping 311 matching lines @@
 #ifndef NDEBUG
 
 // For use in the debugger
 void dumpInnerHTML(blink::HTMLElement*);
 
 void dumpInnerHTML(blink::HTMLElement* element)
 {
     printf("%s\n", element->innerHTML().ascii().data());
 }
 #endif