Avoid crash when updating stylesheets during a remove operation.

third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 187 matching lines @@
 {
     ASSERT(!cssSheet.disabled());
     ASSERT(cssSheet.ownerDocument());
     ASSERT(cssSheet.ownerNode());
     ASSERT(isHTMLStyleElement(cssSheet.ownerNode()) || isSVGStyleElement(cssSheet.ownerNode()) || cssSheet.ownerNode()->treeScope() == cssSheet.ownerDocument());
 
     if (cssSheet.mediaQueries() && !m_medium->eval(cssSheet.mediaQueries(), &m_viewportDependentMediaQueryResults))
         return;
 
     TreeScope* treeScope = &cssSheet.ownerNode()->treeScope();
+    // TODO(rune@opera.com): This is a workaround for crbug.com/559292
+    // when we're in the middle of removing a subtree with a style element
+    // and the treescope has been changed but inDocument and isInShadowTree
+    // are not.
+    //
+    // This check can be removed when crbug.com/567021 is fixed.
+    if (cssSheet.ownerNode()->isInShadowTree() && treeScope->rootNode().isDocumentNode())
+        return;
+
     // Sheets in the document scope of HTML imports apply to the main document
     // (m_document), so we override it for all document scoped sheets.
     if (treeScope->rootNode().isDocumentNode())
         treeScope = m_document;
     treeScope->ensureScopedStyleResolver().appendCSSStyleSheet(cssSheet, *m_medium);
 }
 
 void StyleResolver::appendPendingAuthorStyleSheets()
 {
     for (const auto& styleSheet : m_pendingStyleSheets)
@@ skipping 1338 matching lines @@
     visitor->trace(m_uncommonAttributeRuleSet);
     visitor->trace(m_watchedSelectorsRules);
     visitor->trace(m_treeBoundaryCrossingScopes);
     visitor->trace(m_styleSharingLists);
     visitor->trace(m_pendingStyleSheets);
     visitor->trace(m_document);
 #endif
 }
 
 } // namespace blink