Don't use RenderStyle::clone unless there is actually a RenderObject to attach the cloned style to.

Source/core/css/RuleFeature.cpp

Index: Source/core/css/RuleFeature.cpp
diff --git a/Source/core/css/RuleFeature.cpp b/Source/core/css/RuleFeature.cpp
index a8df5fbbf23489e113dc80a03e65bd146958f110..fef21f20cfb46405eaab71ab95d40ab6ee9521c6 100644
--- a/Source/core/css/RuleFeature.cpp
+++ b/Source/core/css/RuleFeature.cpp
@@ -432,9 +432,16 @@ bool RuleFeatureSet::invalidateStyleForClassChange(Element* element, Vector<Atom
     if (thisElementNeedsStyleRecalc) {
         element->setNeedsStyleRecalc(LocalStyleChange);
     } else if (foundInvalidationSet && someChildrenNeedStyleRecalc) {
-        // Clone the RenderStyle in order to preserve correct style sharing.
-        if (RenderStyle* renderStyle = element->renderStyle())
-            element->renderer()->setStyle(RenderStyle::clone(renderStyle));
+        // Clone the RenderStyle in order to preserve correct style sharing, if possible. Otherwise recalc style.
+        bool clonedStyle = false;
+        if (RenderObject* renderer = element->renderer()) {
+            if (RenderStyle* renderStyle = renderer->style()) {

[esprehn, 2014/03/03 21:43:52]

If you have a renderer you must have a style, this all collapses down to:

if (RenderObject* renderer = element->renderer())
  renderer->setStyleInternal(RenderStyle::clone(renderer->style()));
else
  element->setNeedsStyleRecalc(LocalStyleChange);

[chrishtr, 2014/03/03 21:53:37]

Done.

+                renderer->setStyleInternal(RenderStyle::clone(renderStyle));
+                clonedStyle = true;
+            }
+        }
+        if (!clonedStyle)
+            element->setNeedsStyleRecalc(LocalStyleChange);
     }
 
     invalidationClasses.remove(oldSize, invalidationClasses.size() - oldSize);