Should not allow style sharing if grandparents matches different rule chain

Source/core/css/resolver/SharedStyleFinder.cpp

Index: Source/core/css/resolver/SharedStyleFinder.cpp
diff --git a/Source/core/css/resolver/SharedStyleFinder.cpp b/Source/core/css/resolver/SharedStyleFinder.cpp
index 3d6bd946ede52f6d8b674ec735b5c636ba0ee670..cabed4465bce686b0a26e5aed455c541ae1b393b 100644
--- a/Source/core/css/resolver/SharedStyleFinder.cpp
+++ b/Source/core/css/resolver/SharedStyleFinder.cpp
@@ -157,6 +157,19 @@ bool SharedStyleFinder::sharingCandidateHasIdenticalStyleAffectingAttributes(Ele
     return true;
 }
 
+static bool ancestorChainAllShareStyle(Element* parentA, Element* parentB)
+{
+    while (parentA != parentB) {
+        ASSERT(parentA && parentB);
+        if (parentA->renderStyle() != parentB->renderStyle())
+            return false;
+
+        parentA = parentA->parentElement();
+        parentB = parentB->parentElement();

[esprehn, 2013/10/19 09:10:09]

I don't think this is safe. If parentA has a null parent and parentB does not
you'll crash on line 164.

+    }
+    return true;
+}
+
 bool SharedStyleFinder::canShareStyleWithElement(Element& candidate) const
 {
     if (element() == candidate)
@@ -167,7 +180,7 @@ bool SharedStyleFinder::canShareStyleWithElement(Element& candidate) const
         return false;
     if (!parent)
         return false;
-    if (element().parentElement()->renderStyle() != parent->renderStyle())
+    if (!ancestorChainAllShareStyle(element().parentElement(), parent))
         return false;
     if (style->unique())
         return false;