Don't use stale compositing state in LocalFrame::nodeImage

Source/core/frame/LocalFrame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 536 matching lines @@
         frame->view()->setBaseBackgroundColor(backgroundColor);
         frame->view()->setNodeToDraw(0);
     }
 
     LocalFrame* frame;
     Node* node;
     PaintBehavior paintBehavior;
     Color backgroundColor;
 };
 
-PassOwnPtr<DragImage> LocalFrame::nodeImage(Node* node)
+PassOwnPtr<DragImage> LocalFrame::nodeImage(Node& node)
 {
-    if (!node->renderer())
+    if (!node.renderer())
         return nullptr;
 
-    const ScopedFramePaintingState state(this, node);
+    const ScopedFramePaintingState state(this, &node);
+
+    m_view->updateLayoutAndStyleForPainting();
 
     m_view->setPaintBehavior(state.paintBehavior | PaintBehaviorFlattenCompositingLayers);
 
     // When generating the drag image for an element, ignore the document background.
     m_view->setBaseBackgroundColor(Color::transparent);
 
-    // Updating layout can tear everything down, so ref the LocalFrame and Node to keep them alive.
-    RefPtr<LocalFrame> frameProtector(this);
-    RefPtr<Node> nodeProtector(node);
-    m_view->updateLayoutAndStyleForPainting();
-
-    m_view->setNodeToDraw(node); // Enable special sub-tree drawing mode.
+    m_view->setNodeToDraw(&node); // Enable special sub-tree drawing mode.
 
     // Document::updateLayout may have blown away the original RenderObject.
-    RenderObject* renderer = node->renderer();
+    RenderObject* renderer = node.renderer();
     if (!renderer)
         return nullptr;
 
     LayoutRect topLevelRect;
     IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     ASSERT(document()->isActive());
     float deviceScaleFactor = m_host->deviceScaleFactor();
     paintingRect.setWidth(paintingRect.width() * deviceScaleFactor);
     paintingRect.setHeight(paintingRect.height() * deviceScaleFactor);
@@ skipping 44 matching lines @@
 {
     if (!m_host)
         return 0;
 
     double ratio = m_host->deviceScaleFactor();
     ratio *= pageZoomFactor();
     return ratio;
 }
 
 } // namespace WebCore