selectors: Never match ::slotted on <slot>s.

This fixes the test from https://github.com/w3c/web-platform-tests/pull/9212 in
Gecko.

components/selectors/matching.rs

@@ -416,6 +416,7 @@ where
             element.parent_element()
         }
         Combinator::SlotAssignment => {
+            debug_assert!(element.assigned_slot().map_or(true, |s| s.is_html_slot_element()));
             element.assigned_slot()
         }
         Combinator::PseudoElement => {
@@ -631,6 +632,8 @@ where
         Component::Combinator(_) => unreachable!(),
         Component::Slotted(ref selector) => {
             context.shared.nest(|context| {
+                // <slots> are never flattened tree slottables.
+                !element.is_html_slot_element() &&
                 element.assigned_slot().is_some() &&
                 matches_complex_selector(
                     selector.iter(),

components/selectors/tree.rs

@@ -82,6 +82,9 @@ pub trait Element: Sized + Clone + Debug {
     /// Whether this element is a `link`.
     fn is_link(&self) -> bool;
 
+    /// Returns whether the element is an HTML <slot> element.
+    fn is_html_slot_element(&self) -> bool;
+
     /// Returns the assigned <slot> element this element is assigned to.
     ///
     /// Necessary for the `::slotted` pseudo-class.