Copy m_namespaceRules when copying StyleSheetContents to avoid crashing.

third_party/WebKit/Source/core/css/StyleSheetContents.cpp

Index: third_party/WebKit/Source/core/css/StyleSheetContents.cpp
diff --git a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
index 9eb2844a5dc381cf01e001b8939d36304f48425b..0e6397fa873fbed6093505d54431650d9a884b2d 100644
--- a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
+++ b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
@@ -92,6 +92,11 @@ StyleSheetContents::StyleSheetContents(const StyleSheetContents& o)
   // FIXME: Copy import rules.
   ASSERT(o.m_importRules.isEmpty());
 
+  for (unsigned i = 0; i < m_namespaceRules.size(); ++i) {
+    m_namespaceRules[i] =
+        static_cast<StyleRuleNamespace*>(o.m_namespaceRules[i]->copy());
+  }
+
   // LazyParseCSS: Copying child rules is a strict point for lazy parsing, so
   // there is no need to copy lazy parsing state here.
   for (unsigned i = 0; i < m_childRules.size(); ++i)