The attached crash report shows that we are crashing during slot
assignment when changing the child content of an <option>. Slot
assignment should not crash at this time, so I am adding a CHECK() which
should help show whether an element which might be null is null or not.
It also adds a feature check for <selectlist>, because we shouldn't even
be doing a flat tree traversal with slot assignment recalc here when the
<selectlist> flag is disabled.

(cherry picked from commit e7443b2eb4e4bcd0017291006c66402b9b102d9b)

Fixed: 335599521, 341095522
Change-Id: I336b40e7cc459720922c1487a5870dbef37c7e9b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5464154
Reviewed-by: Di Zhang <dizhangg@chromium.org>
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1289561}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5548510
Auto-Submit: Joey Arhar <jarhar@chromium.org>
Reviewed-by: Mason Freed <masonf@chromium.org>
Commit-Queue: Mason Freed <masonf@chromium.org>
Cr-Commit-Position: refs/branch-heads/6422@{#1054}
Cr-Branched-From: 9012208d0ce02e0cf0adb9b62558627c356f3278-refs/heads/main@{#1287751}