Don't use RenderStyle::clone unless there is actually a RenderObject to attach the cloned style to.

Source/core/css/RuleFeature.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 414 matching lines @@
     bool someChildrenNeedStyleRecalc = false;
     // foundInvalidationSet will be true if we are in a subtree of a node with a DescendantInvalidationSet on it.
     // We need to check all nodes in the subtree of such a node.
     if (foundInvalidationSet || element->childNeedsStyleInvalidation()) {
         someChildrenNeedStyleRecalc = invalidateStyleForClassChangeOnChildren(element, invalidationClasses, foundInvalidationSet);
     }
 
     if (thisElementNeedsStyleRecalc) {
         element->setNeedsStyleRecalc(LocalStyleChange);
     } else if (foundInvalidationSet && someChildrenNeedStyleRecalc) {
-        // Clone the RenderStyle in order to preserve correct style sharing.
-        if (RenderStyle* renderStyle = element->renderStyle())
-            element->renderer()->setStyle(RenderStyle::clone(renderStyle));
+        // Clone the RenderStyle in order to preserve correct style sharing, if possible. Otherwise recalc style.
+        if (RenderObject* renderer = element->renderer()) {
+            ASSERT(renderer->style());
+            renderer->setStyleInternal(RenderStyle::clone(renderer->style()));
+        } else {
+            element->setNeedsStyleRecalc(LocalStyleChange);
+        }
     }
 
     invalidationClasses.remove(oldSize, invalidationClasses.size() - oldSize);
     element->clearChildNeedsStyleInvalidation();
     element->clearNeedsStyleInvalidation();
 
     return thisElementNeedsStyleRecalc;
 }
 
 } // namespace WebCore