AX: ChildrenChanged: don't recurse into slots with pending assignment.

This patch ensures that we don't recurse into slot elements when there
is a pending re-assignment. We already have a check for flat tree
traversal being forbidden; the slot re-assignment can similarly cause
objects to be reshuffled which can cause memory issues for calling
code (e.g. referenced bug).

R=aleventhal@chromium.org, jarhar@chromium.org

Bug: 1255406, 1255464, 1253150
Change-Id: Ic05cb525c40efd269c38adf6c6cd6d4f394e235e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3212929
Commit-Queue: vmpstr <vmpstr@chromium.org>
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Cr-Commit-Position: refs/heads/main@{#929719}

html/semantics/interactive-elements/the-details-element/auto-expand-ax-slot-recalc-crash.html

@@ -0,0 +1,28 @@
+<link rel=help href="https://bugs.chromium.org/p/chromium/issues/detail?id=1255406">
+<script type="text/javascript">
+var nodes = Array();
+var text = Array();
+ {
+ nodes[9] = document.createElement('textarea');
+ nodes[11] = document.createElement('legend');
+ nodes[44] = document.createElement('details');
+ document.documentElement.appendChild(nodes[44]);
+ nodes[68] = document.createElement('fieldset');
+ nodes[81] = document.createElement('option');
+
+
+
+ nodes[85] = document.createElement('img');
+ text[42] = document.createTextNode('744879385');
+ nodes[44].appendChild(text[42]);
+ nodes[68].appendChild(nodes[11]);
+ nodes[44].appendChild(nodes[68]);
+ requestAnimationFrame(() => {
+  requestAnimationFrame(() => {
+   try { nodes[85].appendChild(nodes[68]); } catch(e) {}
+  });
+ });
+ nodes[44].appendChild(nodes[9]);
+ requestAnimationFrame(() => { document.execCommand("SelectAll", false, ""); });
+}
+</script>