Handle fallback content case in FlatTreeTraversal::traverseSiblings()

third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp

Index: third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp
diff --git a/third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp b/third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp
index 8e498b52afc88b645c2629d9c170bf420a0405c4..f2a05a3b0fefa6471fe9a7003b8f7fc9251c5ed2 100644
--- a/third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp
+++ b/third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp
@@ -134,6 +134,15 @@ Node* FlatTreeTraversal::traverseSiblings(const Node& node,
           direction))
     return found;
 
+  // Slotted nodes are already handled in traverseSiblingsForV1HostChild()
+  // above, here is for fallback contents.
+  Element* parent = node.parentElement();
+  if (parent && isHTMLSlotElement(parent)) {
+    HTMLSlotElement& slot = toHTMLSlotElement(*parent);
+    if (slot.supportsDistribution() && slot.assignedNodes().isEmpty())
+      return traverseSiblings(slot, direction);
+  }
+
   if (!node.isInV0ShadowTree())
     return nullptr;