Replace RawPtr with RefPtr on StylePendingImage

This change ensures StylePendingImages set on ComputedStyles will keep
their corresponding CSSValue alive.
The PendingImagePropertyMap on ElementStyleResources was supposed to do
this however it only keeps alive one per property while properties can
have any number of images set on them (background-image).

Prior to this change StylePendingImages held a RawPtr to their CSSValue
to avoid a ref loop because the CSSValue would hold a RefPtr to the
StylePendingImage as a cache.

After this change StylePendingImages hold RefPtrs to their CSSValue
while CSSValues no longer cache StylePendingImages. Having multiple
StylePendingImages per CSSValue is equivalent to using cached
StylePendingImages as no state changes on the StylePendingImage
during the StyleResourceLoader pass.

The old scenario is not currently a problem as all applied CSSValues
have their refs held elsewhere (style rules or AnimatableImages).
Future animation work intends to apply temporary CSSValue images and
must ensure StylePendingImages keep a ref to avoid a use after free.

This patch is a refactor towards memory management correctness and has
no behavioural changes.

BUG=437696

Review URL: https://codereview.chromium.org/1368613002

Cr-Commit-Position: refs/heads/master@{#350808}

1 files changed, 2 insertions, 2 deletions

diff --git a/third_party/WebKit/Source/core/css/CSSCrossfadeValue.cpp b/third_party/WebKit/Source/core/css/CSSCrossfadeValue.cpp
index 3816da2..d4a3208 100644
--- a/third_party/WebKit/Source/core/css/CSSCrossfadeValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSCrossfadeValue.cpp
@@ -37,7 +37,7 @@ namespace blink {
 static bool subimageIsPending(CSSValue* value)
 {
     if (value->isImageValue())
-        return toCSSImageValue(value)->cachedOrPendingImage()->isPendingImage();
+        return toCSSImageValue(value)->isCachePending();
 
     if (value->isImageGeneratorValue())
         return toCSSImageGeneratorValue(value)->isPending();
@@ -66,7 +66,7 @@ static ImageResource* cachedImageForCSSValue(CSSValue* value, Document* document
         return nullptr;
 
     if (value->isImageValue()) {
-        StyleFetchedImage* styleImageResource = toCSSImageValue(value)->cachedImage(document);
+        StyleFetchedImage* styleImageResource = toCSSImageValue(value)->cacheImage(document);
         if (!styleImageResource)
             return nullptr;