Avoid crash when updating stylesheets during a remove operation.

third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp

Index: third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp
diff --git a/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp b/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp
index 92e8830a36bec9c65a8106c62c249708ae7c0247..f40d913e1939c8fb3b5848705971bac66f476173 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp
@@ -205,6 +205,15 @@ void StyleResolver::appendCSSStyleSheet(CSSStyleSheet& cssSheet)
         return;
 
     TreeScope* treeScope = &cssSheet.ownerNode()->treeScope();
+    // TODO(rune@opera.com): This is a workaround for crbug.com/559292
+    // when we're in the middle of removing a subtree with a style element
+    // and the treescope has been changed but inDocument and isInShadowTree
+    // are not.
+    //
+    // This check can be removed when crbug.com/567021 is fixed.
+    if (cssSheet.ownerNode()->isInShadowTree() && treeScope->rootNode().isDocumentNode())
+        return;
+
     // Sheets in the document scope of HTML imports apply to the main document
     // (m_document), so we override it for all document scoped sheets.
     if (treeScope->rootNode().isDocumentNode())