Make View::Paint use ui::PaintRecorder to access PaintContext's canvas

ui/compositor/paint_context.h

Index: ui/compositor/paint_context.h
diff --git a/ui/compositor/paint_context.h b/ui/compositor/paint_context.h
index b0773f1615db9fd93f134743cf38d6ced99172af..fd3ecd4f4a5926e619f6f714905fd485176edfab 100644
--- a/ui/compositor/paint_context.h
+++ b/ui/compositor/paint_context.h
@@ -14,6 +14,7 @@ class Canvas;
 }
 
 namespace ui {
+class PaintRecorder;
 
 class COMPOSITOR_EXPORT PaintContext {
  public:
@@ -68,6 +69,11 @@ class COMPOSITOR_EXPORT PaintContext {
 #endif
 
  private:
+  // The PaintRecorder needs access to the internal canvas and friends, but we
+  // don't want to expose them on this class so that people must go through the
+  // recorder to access them.
+  friend class PaintRecorder;
+
   // Clone a PaintContext with an additional |offset|.
   PaintContext(const PaintContext& other, const gfx::Vector2d& offset)
       : canvas_(other.canvas_),