Don't hold weak ref to ComputedStyle in BoxPainter.

Currently we hold a const ref& to a ComputedStyle object in BoxPainter::
PaintBoxDecorationBackgroundWithRect. However, this ref could be
invalidated during theme painting, which would cause a dangling ref
issue when we use the ref later on.

This patch removes the weak ref and instead uses StyleRef() to grab a
fresh style ref each time.

Bug: 712933
Change-Id: Id576005fe63ac3a014002ba5a68acbb6c88382b0
Reviewed-on: https://chromium-review.googlesource.com/566198Reviewed-by: Stephen Chenney <schenney@chromium.org>
Commit-Queue: Darren Shen <shend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#486266}

third_party/WebKit/Source/core/paint/BoxPainter.cpp

@@ -106,14 +106,12 @@ void BoxPainter::PaintBoxDecorationBackgroundWithRect(
   bool painting_overflow_contents =
       IsPaintingBackgroundOfPaintContainerIntoScrollingContentsLayer(
           &layout_box_, paint_info);
-  const ComputedStyle& style = layout_box_.StyleRef();
-
   Optional<DisplayItemCacheSkipper> cache_skipper;
   // Disable cache in under-invalidation checking mode for MediaSliderPart
   // because we always paint using the latest data (buffered ranges, current
   // time and duration) which may be different from the cached data.
   if ((RuntimeEnabledFeatures::PaintUnderInvalidationCheckingEnabled() &&
-       style.Appearance() == kMediaSliderPart)
+       layout_box_.StyleRef().Appearance() == kMediaSliderPart)
       // We may paint a delayed-invalidation object before it's actually
       // invalidated. Note this would be handled for us by
       // LayoutObjectDrawingRecorder but we have to use DrawingRecorder as we
@@ -145,11 +143,12 @@ void BoxPainter::PaintBoxDecorationBackgroundWithRect(
     // FIXME: Should eventually give the theme control over whether the box
     // shadow should paint, since controls could have custom shadows of their
     // own.
-    PaintNormalBoxShadow(paint_info, paint_rect, style);
+    PaintNormalBoxShadow(paint_info, paint_rect, layout_box_.StyleRef());
 
     if (BleedAvoidanceIsClipping(box_decoration_data.bleed_avoidance)) {
       state_saver.Save();
-      FloatRoundedRect border = style.GetRoundedBorderFor(paint_rect);
+      FloatRoundedRect border =
+          layout_box_.StyleRef().GetRoundedBorderFor(paint_rect);
       paint_info.context.ClipRoundedRect(border);
 
       if (box_decoration_data.bleed_avoidance == kBackgroundBleedClipLayer)
@@ -179,7 +178,7 @@ void BoxPainter::PaintBoxDecorationBackgroundWithRect(
   }
 
   if (!painting_overflow_contents) {
-    PaintInsetBoxShadow(paint_info, paint_rect, style);
+    PaintInsetBoxShadow(paint_info, paint_rect, layout_box_.StyleRef());
 
     // The theme will tell us whether or not we should also paint the CSS
     // border.
@@ -191,7 +190,8 @@ void BoxPainter::PaintBoxDecorationBackgroundWithRect(
         !(layout_box_.IsTable() &&
           ToLayoutTable(&layout_box_)->ShouldCollapseBorders())) {
       PaintBorder(layout_box_, layout_box_.GetDocument(), GetNode(), paint_info,
-                  paint_rect, style, box_decoration_data.bleed_avoidance);
+                  paint_rect, layout_box_.StyleRef(),
+                  box_decoration_data.bleed_avoidance);
     }
   }