diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp
index f19aa572c0..1ecf80bc52 100644
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@@ -1732,7 +1732,13 @@ static bool SelectorMatches(Element* aElement,
 
   Element* targetElement = aElement;
   if (aTreeMatchContext.mForAssignedSlot) {
-    targetElement = aElement->GetAssignedSlot()->AsElement();
+    HTMLSlotElement* slot = aElement->GetAssignedSlot();
+    // We're likely testing the slottable's ancestors and it might
+    // not have an assigned slot, so return early.
+    if (!slot) {
+      return false;
+    }
+    targetElement = slot->AsElement();
   }
 
   // namespace/tag match