From 1c2dd6aee0228dd95ad3495ae6c6a2afdf76a5ae Mon Sep 17 00:00:00 2001
From: FranklinDM <mrmineshafter17@gmail.com>
Date: Sun, 21 May 2023 15:17:29 +0800
Subject: [PATCH] Issue #2250 - Part 1: Return early if the element being
 tested for is likely an ancestor and does not have an assigned slot

---
 layout/style/nsCSSRuleProcessor.cpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp
index f19aa572c0..1ecf80bc52 100644
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@@ -1732,7 +1732,13 @@ static bool SelectorMatches(Element* aElement,
 
   Element* targetElement = aElement;
   if (aTreeMatchContext.mForAssignedSlot) {
-    targetElement = aElement->GetAssignedSlot()->AsElement();
+    HTMLSlotElement* slot = aElement->GetAssignedSlot();
+    // We're likely testing the slottable's ancestors and it might
+    // not have an assigned slot, so return early.
+    if (!slot) {
+      return false;
+    }
+    targetElement = slot->AsElement();
   }
 
   // namespace/tag match