Fix a crash caused by changing dir attribute of a slot element

HTMLElement::dirAttributeChaged() calls FlatTreeTraversal::parent(*this)
unconditionally. Since Blink does not support "slots in a flat tree", we
should return early here for a slot element.

BUG=627385

Review-Url: https://codereview.chromium.org/2172133002
Cr-Commit-Position: refs/heads/master@{#407108}
2 files changed