[layoutng] Fix CFI bot failures

Due to https://chromium-review.googlesource.com/c/chromium/src/+/1296491

See log: https://ci.chromium.org/p/chromium/builders/luci.chromium.ci/Linux%20CFI/10902

TBR=mstensho@chromium.org

Bug: 898540
Change-Id: I2e3e3ead85602b111ca423cb89b1a0ce2813f170
Reviewed-on: https://chromium-review.googlesource.com/c/1298015Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Christian Biesinger <cbiesinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#602443}

third_party/blink/renderer/core/layout/ng/ng_block_break_token.h

@@ -44,14 +44,13 @@ class CORE_EXPORT NGBlockBreakToken final : public NGBreakToken {
       LayoutUnit used_block_size,
       const NGBreakTokenVector& child_break_tokens,
       bool has_last_resort_break = false) {
-    NGBlockBreakToken* token =
-        static_cast<NGBlockBreakToken*>(::WTF::Partitions::FastMalloc(
-            sizeof(NGBlockBreakToken) +
-                child_break_tokens.size() * sizeof(NGBreakToken*),
-            ::WTF::GetStringWithTypeName<NGBlockBreakToken>()));
+    void* token = ::WTF::Partitions::FastMalloc(
+        sizeof(NGBlockBreakToken) +
+            child_break_tokens.size() * sizeof(NGBreakToken*),
+        ::WTF::GetStringWithTypeName<NGBlockBreakToken>());
     new (token) NGBlockBreakToken(node, used_block_size, child_break_tokens,
                                   has_last_resort_break);
-    return base::AdoptRef(token);
+    return base::AdoptRef(static_cast<NGBlockBreakToken*>(token));
   }
 
   // Creates a break token for a node which cannot produce any more fragments.