Copy m_namespaceRules when copying StyleSheetContents to avoid crashing.

third_party/WebKit/Source/core/css/StyleSheetContents.cpp

Index: third_party/WebKit/Source/core/css/StyleSheetContents.cpp
diff --git a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
index 9eb2844a5dc381cf01e001b8939d36304f48425b..e897fc42dea471ab8c0e2f69772729b603139c94 100644
--- a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
+++ b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
@@ -94,6 +94,11 @@ StyleSheetContents::StyleSheetContents(const StyleSheetContents& o)
 
   // LazyParseCSS: Copying child rules is a strict point for lazy parsing, so

[Timothy Loh, 2016/11/01 03:30:35]

This comment should probably stay attached to the below loop.

[meade_UTC10, 2016/11/01 04:54:12]

Done.

   // there is no need to copy lazy parsing state here.
+  for (unsigned i = 0; i < m_namespaceRules.size(); ++i) {
+    m_namespaceRules[i] =
+        static_cast<StyleRuleNamespace*>(o.m_namespaceRules[i]->copy());
+  }
+
   for (unsigned i = 0; i < m_childRules.size(); ++i)
     m_childRules[i] = o.m_childRules[i]->copy();
 }