Fix a crash: SlotAssignment is unintentionally created for v0 shadow trees

third_party/WebKit/Source/core/html/HTMLSlotElement.cpp

 /*
  * Copyright (C) 2015 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 215 matching lines @@
 
 Node::InsertionNotificationRequest HTMLSlotElement::insertedInto(ContainerNode* insertionPoint)
 {
     HTMLElement::insertedInto(insertionPoint);
     ShadowRoot* root = containingShadowRoot();
     if (root) {
         DCHECK(root->owner());
         root->owner()->setNeedsDistributionRecalc();
         // Relevant DOM Standard: https://dom.spec.whatwg.org/#concept-node-insert
         // - 6.4:  Run assign slotables for a tree with node's tree and a set containing each inclusive descendant of node that is a slot.
-        if (!wasInShadowTreeBeforeInserted(*this, *insertionPoint))
+        if (root->isV1() && !wasInShadowTreeBeforeInserted(*this, *insertionPoint))
             root->ensureSlotAssignment().slotAdded(*this);
     }
 
     // We could have been distributed into in a detached subtree, make sure to
     // clear the distribution when inserted again to avoid cycles.
     clearDistribution();
 
     return InsertionDone;
 }
 
@@ skipping 109 matching lines @@
 DEFINE_TRACE(HTMLSlotElement)
 {
     visitor->trace(m_assignedNodes);
     visitor->trace(m_distributedNodes);
     visitor->trace(m_oldDistributedNodes);
     visitor->trace(m_distributedIndices);
     HTMLElement::trace(visitor);
 }
 
 } // namespace blink