Fix a crash: SlotAssignment is unintentionally created for v0 shadow trees

third_party/WebKit/Source/core/html/HTMLSlotElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp b/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
index b9a007902c98a82c3678e6e6e59269d1e7438639..7998d036960d83beca721cd173d0c9ccda3bc64f 100644
--- a/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
@@ -233,7 +233,7 @@ Node::InsertionNotificationRequest HTMLSlotElement::insertedInto(ContainerNode*
         root->owner()->setNeedsDistributionRecalc();
         // Relevant DOM Standard: https://dom.spec.whatwg.org/#concept-node-insert
         // - 6.4:  Run assign slotables for a tree with node's tree and a set containing each inclusive descendant of node that is a slot.
-        if (!wasInShadowTreeBeforeInserted(*this, *insertionPoint))
+        if (root->isV1() && !wasInShadowTreeBeforeInserted(*this, *insertionPoint))
             root->ensureSlotAssignment().slotAdded(*this);
     }