Should not allow style sharing if grandparents matches different rule chain

Source/core/css/resolver/SharedStyleFinder.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 139 matching lines @@
     // that sharing the style makes sense. Instead we should just not support style sharing
     // for them.
     if (element().hasTagName(progressTag)) {
         if (element().shouldAppearIndeterminate() != candidate.shouldAppearIndeterminate())
             return false;
     }
 
     return true;
 }
 
+static bool ancestorChainAllShareStyle(Element* parentA, Element* parentB)
+{
+    while (parentA != parentB) {
+        ASSERT(parentA && parentB);
+        if (parentA->renderStyle() != parentB->renderStyle())
+            return false;
+
+        parentA = parentA->parentElement();
+        parentB = parentB->parentElement();

[esprehn, 2013/10/19 09:10:09]

I don't think this is safe. If parentA has a null parent and parentB does not
you'll crash on line 164.

+    }
+    return true;
+}
+
 bool SharedStyleFinder::canShareStyleWithElement(Element& candidate) const
 {
     if (element() == candidate)
         return false;
     Element* parent = candidate.parentElement();
     RenderStyle* style = candidate.renderStyle();
     if (!style)
         return false;
     if (!parent)
         return false;
-    if (element().parentElement()->renderStyle() != parent->renderStyle())
+    if (!ancestorChainAllShareStyle(element().parentElement(), parent))
         return false;
     if (style->unique())
         return false;
     if (style->hasUniquePseudoStyle())
         return false;
     if (candidate.tagQName() != element().tagQName())
         return false;
     if (candidate.inlineStyle())
         return false;
     if (candidate.needsStyleRecalc())
@@ skipping 151 matching lines @@
     if (matchesRuleSet(m_siblingRuleSet) || matchesRuleSet(m_uncommonAttributeRuleSet))
         return 0;
     // Tracking child index requires unique style for each node. This may get set by the sibling rule match above.
     if (element().parentElement()->childrenSupportStyleSharing())
         return 0;
     STYLE_STATS_ADD_STYLE_SHARED();
     return shareElement->renderStyle();
 }
 
 }