Handle null SlotAssignment.

Moving an element between two shadow hosts may cause us to end up with a
null SlotAssignments() walking a dirty flat tree ancestry. Add a null
check in that case. The slot re-assignment of the dirty flat tree will
make sure ancestors are marked appropriately.

Bug: 1023082
Change-Id: Icb2fd03d91f5b020010bee6038d0ac0c72c6ab7b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1910080Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#714200}

third_party/blink/renderer/core/css/style_engine_test.cc

@@ -2369,4 +2369,32 @@ TEST_F(StyleEngineTest, GetComputedStyleOutsideFlatTree) {
             innermost_style->VisitedDependentColor(GetCSSPropertyColor()));
 }
 
+TEST_F(StyleEngineTest, MoveSlottedOutsideFlatTreeCrash) {
+  ScopedFlatTreeStyleRecalcForTest feature_scope(true);
+
+  GetDocument().body()->SetInnerHTMLFromString(R"HTML(
+    <div id="host1"><span></span></div>
+    <div id="host2"></div>
+  )HTML");
+
+  auto* host1 = GetDocument().getElementById("host1");
+  auto* host2 = GetDocument().getElementById("host2");
+  auto* span = host1->firstChild();
+
+  ShadowRoot& shadow_root =
+      host1->AttachShadowRootInternal(ShadowRootType::kOpen);
+  shadow_root.SetInnerHTMLFromString("<slot></slot>");
+  host2->AttachShadowRootInternal(ShadowRootType::kOpen);
+
+  UpdateAllLifecyclePhases();
+
+  host2->appendChild(span);
+  EXPECT_EQ(span, GetStyleRecalcRoot());
+
+  // Removing the span will fall back to using the host parent as the new style
+  // recalc root.
+  span->remove();
+  EXPECT_EQ(host2, GetStyleRecalcRoot());
+}
+
 }  // namespace blink

third_party/blink/renderer/core/css/style_recalc_root.cc

@@ -64,6 +64,8 @@ base::Optional<Member<Element>> FirstFlatTreeAncestorForChildDirty(
     // V0. It is too complicated to try to find the closest flat tree parent.
     return base::nullopt;
   }
+  if (!root->HasSlotAssignment())
+    return base::nullopt;
   // The child has already been removed, so we cannot look up its slot
   // assignment directly. Find the slot which was part of the ancestor chain
   // before the removal by checking the child-dirty bits. Since the recalc root