Copy m_namespaceRules when copying StyleSheetContents to avoid crashing.

third_party/WebKit/Source/core/css/StyleSheetContents.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 74 matching lines @@
       m_isMutable(false),
       m_hasFontFaceRule(o.m_hasFontFaceRule),
       m_hasViewportRule(o.m_hasViewportRule),
       m_hasMediaQueries(o.m_hasMediaQueries),
       m_hasSingleOwnerDocument(true),
       m_isUsedFromTextCache(false),
       m_parserContext(o.m_parserContext) {
   // FIXME: Copy import rules.
   ASSERT(o.m_importRules.isEmpty());
 
+  for (unsigned i = 0; i < m_namespaceRules.size(); ++i) {
+    m_namespaceRules[i] =
+        static_cast<StyleRuleNamespace*>(o.m_namespaceRules[i]->copy());
+  }
+
   for (unsigned i = 0; i < m_childRules.size(); ++i)
     m_childRules[i] = o.m_childRules[i]->copy();
 }
 
 StyleSheetContents::~StyleSheetContents() {}
 
 void StyleSheetContents::setHasSyntacticallyValidCSSHeader(bool isValidCss) {
   m_hasSyntacticallyValidCSSHeader = isValidCss;
 }
 
@@ skipping 162 matching lines @@
   index -= m_namespaceRules.size();
 
   m_childRules.insert(index, rule);
   return true;
 }
 
 bool StyleSheetContents::wrapperDeleteRule(unsigned index) {
   ASSERT(m_isMutable);
   ASSERT_WITH_SECURITY_IMPLICATION(index < ruleCount());
 
+  StyleRuleNamespace* test;
+  test = m_namespaceRules[0].get();

[rune, 2016/10/28 07:41:16]

What's this for?

[meade_UTC10, 2016/10/31 01:32:53]

Oops, removed.

   if (index < m_importRules.size()) {
     m_importRules[index]->clearParentStyleSheet();
     if (m_importRules[index]->isFontFaceRule())
       notifyRemoveFontFaceRule(toStyleRuleFontFace(m_importRules[index].get()));
     m_importRules.remove(index);
     return true;
   }
   index -= m_importRules.size();
 
   if (index < m_namespaceRules.size()) {
@@ skipping 379 matching lines @@
   visitor->trace(m_importRules);
   visitor->trace(m_namespaceRules);
   visitor->trace(m_childRules);
   visitor->trace(m_loadingClients);
   visitor->trace(m_completedClients);
   visitor->trace(m_ruleSet);
   visitor->trace(m_referencedFromResource);
 }
 
 }  // namespace blink