Fix memory error during selector matching due to getMatchedCSSRules.

Source/core/css/CSSStyleSheet.cpp

Index: Source/core/css/CSSStyleSheet.cpp
diff --git a/Source/core/css/CSSStyleSheet.cpp b/Source/core/css/CSSStyleSheet.cpp
index 9737560190271c7ebc8e6aa57ef768b288dd7777..02e6f5463650ad96ce65072ce8489f9630a0f9d1 100644
--- a/Source/core/css/CSSStyleSheet.cpp
+++ b/Source/core/css/CSSStyleSheet.cpp
@@ -28,6 +28,7 @@
 #include "core/css/CSSImportRule.h"
 #include "core/css/CSSParser.h"
 #include "core/css/CSSRuleList.h"
+#include "core/css/CSSStyleRule.h"
 #include "core/css/MediaList.h"
 #include "core/css/StyleRule.h"
 #include "core/css/StyleSheetContents.h"
@@ -117,12 +118,39 @@ CSSStyleSheet::~CSSStyleSheet()
         if (m_childRuleCSSOMWrappers[i])
             m_childRuleCSSOMWrappers[i]->setParentStyleSheet(0);
     }
+
+    for (unsigned i = 0; i < m_extraChildRuleCSSOMWrappers.size(); ++i)
+        m_extraChildRuleCSSOMWrappers[i]->setParentStyleSheet(0);
+
     if (m_mediaCSSOMWrapper)
         m_mediaCSSOMWrapper->clearParentStyleSheet();
 
     m_contents->unregisterClient(this);
 }
 
+void CSSStyleSheet::extraCSSOMWrapperIndices(Vector<unsigned>& indices)
+{
+    indices.grow(m_extraChildRuleCSSOMWrappers.size());
+
+    for (unsigned i = 0; i < m_extraChildRuleCSSOMWrappers.size(); ++i) {
+        CSSRule* cssRule = m_extraChildRuleCSSOMWrappers[i].get();
+        ASSERT(cssRule->type() == CSSRule::STYLE_RULE);
+        StyleRule* styleRule = toCSSStyleRule(cssRule)->styleRule();
+
+        bool didFindIndex = false;
+        for (unsigned j = 0; j < m_contents->ruleCount(); ++j) {
+            if (m_contents->ruleAt(j) == styleRule) {
+                didFindIndex = true;
+                indices[i] = j;
+                break;
+            }
+        }
+        ASSERT(didFindIndex);
+        if (!didFindIndex)
+            indices[i] = 0;
+    }
+}
+
 void CSSStyleSheet::willMutateRules()
 {
     // If we are the only client it is safe to mutate.
@@ -133,6 +161,9 @@ void CSSStyleSheet::willMutateRules()
     // Only cacheable stylesheets should have multiple clients.
     ASSERT(m_contents->isCacheable());
 
+    Vector<unsigned> indices;
+    extraCSSOMWrapperIndices(indices);
+
     // Copy-on-write.
     m_contents->unregisterClient(this);
     m_contents = m_contents->copy();
@@ -141,7 +172,7 @@ void CSSStyleSheet::willMutateRules()
     m_contents->setMutable();
 
     // Any existing CSSOM wrappers need to be connected to the copied child rules.
-    reattachChildRuleCSSOMWrappers();
+    reattachChildRuleCSSOMWrappers(indices);
 }
 
 void CSSStyleSheet::didMutateRules()
@@ -164,8 +195,17 @@ void CSSStyleSheet::didMutate(StyleSheetUpdateType updateType)
     owner->modifiedStyleSheet(this, RecalcStyleDeferred, updateMode);
 }
 
-void CSSStyleSheet::reattachChildRuleCSSOMWrappers()
+void CSSStyleSheet::registerExtraChildRuleCSSOMWrapper(PassRefPtr<CSSRule> rule)
 {
+    m_extraChildRuleCSSOMWrappers.append(rule);
+}
+
+void CSSStyleSheet::reattachChildRuleCSSOMWrappers(const Vector<unsigned>& extraCSSOMWrapperIndices)
+{
+    ASSERT(extraCSSOMWrapperIndices.size() == m_extraChildRuleCSSOMWrappers.size());
+    for (unsigned i = 0; i < extraCSSOMWrapperIndices.size(); ++i)
+        m_extraChildRuleCSSOMWrappers[i]->reattach(m_contents->ruleAt(extraCSSOMWrapperIndices[i]));
+
     for (unsigned i = 0; i < m_childRuleCSSOMWrappers.size(); ++i) {
         if (!m_childRuleCSSOMWrappers[i])
             continue;