Fix a crash: SlotAssignment is unintentionally created for v0 shadow trees

third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/shadow/SlotAssignment.h"
 
 #include "core/HTMLNames.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/shadow/ElementShadow.h"
@@ skipping 87 matching lines @@
         m_owner->owner()->setNeedsDistributionRecalc();
     }
 }
 
 SlotAssignment::SlotAssignment(ShadowRoot& owner)
     : m_slotMap(DocumentOrderedMap::create())
     , m_owner(&owner)
     , m_needsCollectSlots(false)
     , m_slotCount(0)
 {
+    DCHECK(owner.isV1());
 }
 
 static void detachNotAssignedNode(Node& node)
 {
     if (node.layoutObject())
         node.lazyReattachIfAttached();
 }
 
 void SlotAssignment::resolveAssignment()
 {
@@ skipping 59 matching lines @@
 }
 
 DEFINE_TRACE(SlotAssignment)
 {
     visitor->trace(m_slots);
     visitor->trace(m_slotMap);
     visitor->trace(m_owner);
 }
 
 } // namespace blink