Fix memory error during selector matching due to getMatchedCSSRules.

Source/core/css/CSSStyleSheet.h

Index: Source/core/css/CSSStyleSheet.h
diff --git a/Source/core/css/CSSStyleSheet.h b/Source/core/css/CSSStyleSheet.h
index c0eeb6f0d1db2c5fafcc847e01f3dfe3fda6e742..6740a6bb89b22700986ddc4de0497e8b7ab68407 100644
--- a/Source/core/css/CSSStyleSheet.h
+++ b/Source/core/css/CSSStyleSheet.h
@@ -103,7 +103,8 @@ public:
     void didMutate(StyleSheetUpdateType = PartialRuleUpdate);
 
     void clearChildRuleCSSOMWrappers();
-    void reattachChildRuleCSSOMWrappers();
+
+    void registerExtraChildRuleCSSOMWrapper(PassRefPtr<CSSRule>);
 
     StyleSheetContents* contents() const { return m_contents.get(); }
 
@@ -117,6 +118,9 @@ private:
     virtual bool isCSSStyleSheet() const { return true; }
     virtual String type() const { return "text/css"; }
 
+    void extraCSSOMWrapperIndices(Vector<unsigned>& indices);
+    void reattachChildRuleCSSOMWrappers(const Vector<unsigned>& extraCSSOMWrapperIndices);
+
     bool canAccessRules() const;
 
     RefPtr<StyleSheetContents> m_contents;
@@ -132,6 +136,9 @@ private:
 
     mutable RefPtr<MediaList> m_mediaCSSOMWrapper;
     mutable Vector<RefPtr<CSSRule> > m_childRuleCSSOMWrappers;
+    // These are CSSOMWrappers that come from getMatchedCSSRules and thus don't map 1-1 to
+    // the StyleRules in the StyleSheetContents.
+    mutable Vector<RefPtr<CSSRule> > m_extraChildRuleCSSOMWrappers;
     mutable OwnPtr<CSSRuleList> m_ruleListCSSOMWrapper;
 };