Don't use RenderStyle::clone unless there is actually a RenderObject to attach the cloned style to.

Source/core/css/RuleFeature.cpp

Index: Source/core/css/RuleFeature.cpp
diff --git a/Source/core/css/RuleFeature.cpp b/Source/core/css/RuleFeature.cpp
index a8df5fbbf23489e113dc80a03e65bd146958f110..0a21f4ca358b3c6a45cbb5c8e3241ae880d76c0b 100644
--- a/Source/core/css/RuleFeature.cpp
+++ b/Source/core/css/RuleFeature.cpp
@@ -432,9 +432,13 @@ bool RuleFeatureSet::invalidateStyleForClassChange(Element* element, Vector<Atom
     if (thisElementNeedsStyleRecalc) {
         element->setNeedsStyleRecalc(LocalStyleChange);
     } else if (foundInvalidationSet && someChildrenNeedStyleRecalc) {
-        // Clone the RenderStyle in order to preserve correct style sharing.
-        if (RenderStyle* renderStyle = element->renderStyle())
-            element->renderer()->setStyle(RenderStyle::clone(renderStyle));
+        // Clone the RenderStyle in order to preserve correct style sharing, if possible. Otherwise recalc style.
+        if (RenderObject* renderer = element->renderer()) {
+            ASSERT(renderer->style());
+            renderer->setStyleInternal(RenderStyle::clone(renderer->style()));
+        } else {
+            element->setNeedsStyleRecalc(LocalStyleChange);
+        }
     }
 
     invalidationClasses.remove(oldSize, invalidationClasses.size() - oldSize);