Copy m_namespaceRules when copying StyleSheetContents to avoid crashing.

third_party/WebKit/Source/core/css/StyleSheetContents.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 74 matching lines @@
       m_isMutable(false),
       m_hasFontFaceRule(o.m_hasFontFaceRule),
       m_hasViewportRule(o.m_hasViewportRule),
       m_hasMediaQueries(o.m_hasMediaQueries),
       m_hasSingleOwnerDocument(true),
       m_isUsedFromTextCache(false),
       m_parserContext(o.m_parserContext) {
   // FIXME: Copy import rules.
   ASSERT(o.m_importRules.isEmpty());
 
   // LazyParseCSS: Copying child rules is a strict point for lazy parsing, so

[Timothy Loh, 2016/11/01 03:30:35]

This comment should probably stay attached to the below loop.

[meade_UTC10, 2016/11/01 04:54:12]

Done.

   // there is no need to copy lazy parsing state here.
+  for (unsigned i = 0; i < m_namespaceRules.size(); ++i) {
+    m_namespaceRules[i] =
+        static_cast<StyleRuleNamespace*>(o.m_namespaceRules[i]->copy());
+  }
+
   for (unsigned i = 0; i < m_childRules.size(); ++i)
     m_childRules[i] = o.m_childRules[i]->copy();
 }
 
 StyleSheetContents::~StyleSheetContents() {}
 
 void StyleSheetContents::setHasSyntacticallyValidCSSHeader(bool isValidCss) {
   m_hasSyntacticallyValidCSSHeader = isValidCss;
 }
 
@@ skipping 562 matching lines @@
   visitor->trace(m_importRules);
   visitor->trace(m_namespaceRules);
   visitor->trace(m_childRules);
   visitor->trace(m_loadingClients);
   visitor->trace(m_completedClients);
   visitor->trace(m_ruleSet);
   visitor->trace(m_referencedFromResource);
 }
 
 }  // namespace blink