Fix memory error during selector matching due to getMatchedCSSRules.

Source/core/css/CSSStyleSheet.h

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 85 matching lines @@
 
     private:
         CSSStyleSheet* m_styleSheet;
     };
 
     void willMutateRules();
     void didMutateRules();
     void didMutate(StyleSheetUpdateType = PartialRuleUpdate);
 
     void clearChildRuleCSSOMWrappers();
-    void reattachChildRuleCSSOMWrappers();
+
+    void registerExtraChildRuleCSSOMWrapper(PassRefPtr<CSSRule>);
 
     StyleSheetContents* contents() const { return m_contents.get(); }
 
     bool isInline() const { return m_isInlineStylesheet; }
     TextPosition startPositionInSource() const { return m_startPosition; }
 
 private:
     CSSStyleSheet(PassRefPtr<StyleSheetContents>, CSSImportRule* ownerRule);
     CSSStyleSheet(PassRefPtr<StyleSheetContents>, Node* ownerNode, bool isInlineStylesheet, const TextPosition& startPosition);
 
     virtual bool isCSSStyleSheet() const { return true; }
     virtual String type() const { return "text/css"; }
 
+    void extraCSSOMWrapperIndices(Vector<unsigned>& indices);
+    void reattachChildRuleCSSOMWrappers(const Vector<unsigned>& extraCSSOMWrapperIndices);
+
     bool canAccessRules() const;
 
     RefPtr<StyleSheetContents> m_contents;
     bool m_isInlineStylesheet;
     bool m_isDisabled;
     String m_title;
     RefPtr<MediaQuerySet> m_mediaQueries;
 
     Node* m_ownerNode;
     CSSRule* m_ownerRule;
 
     TextPosition m_startPosition;
 
     mutable RefPtr<MediaList> m_mediaCSSOMWrapper;
     mutable Vector<RefPtr<CSSRule> > m_childRuleCSSOMWrappers;
+    // These are CSSOMWrappers that come from getMatchedCSSRules and thus don't map 1-1 to
+    // the StyleRules in the StyleSheetContents.
+    mutable Vector<RefPtr<CSSRule> > m_extraChildRuleCSSOMWrappers;
     mutable OwnPtr<CSSRuleList> m_ruleListCSSOMWrapper;
 };
 
 inline CSSStyleSheet::RuleMutationScope::RuleMutationScope(CSSStyleSheet* sheet)
     : m_styleSheet(sheet)
 {
     if (m_styleSheet)
         m_styleSheet->willMutateRules();
 }
 
 inline CSSStyleSheet::RuleMutationScope::RuleMutationScope(CSSRule* rule)
     : m_styleSheet(rule ? rule->parentStyleSheet() : 0)
 {
     if (m_styleSheet)
         m_styleSheet->willMutateRules();
 }
 
 inline CSSStyleSheet::RuleMutationScope::~RuleMutationScope()
 {
     if (m_styleSheet)
         m_styleSheet->didMutateRules();
 }
 
 } // namespace
 
 #endif