Don't use stale compositing state in LocalFrame::nodeImage

Source/core/frame/LocalFrame.cpp

Index: Source/core/frame/LocalFrame.cpp
diff --git a/Source/core/frame/LocalFrame.cpp b/Source/core/frame/LocalFrame.cpp
index 864bbed24e9431c22b7a1889a56650c21e03615c..87b0b5e5638065a9bcc29fd04ed044ab02271ae4 100644
--- a/Source/core/frame/LocalFrame.cpp
+++ b/Source/core/frame/LocalFrame.cpp
@@ -554,27 +554,24 @@ struct ScopedFramePaintingState {
     Color backgroundColor;
 };
 
-PassOwnPtr<DragImage> LocalFrame::nodeImage(Node* node)
+PassOwnPtr<DragImage> LocalFrame::nodeImage(Node& node)
 {
-    if (!node->renderer())
+    if (!node.renderer())
         return nullptr;
 
-    const ScopedFramePaintingState state(this, node);
+    const ScopedFramePaintingState state(this, &node);
+
+    m_view->updateLayoutAndStyleForPainting();
 
     m_view->setPaintBehavior(state.paintBehavior | PaintBehaviorFlattenCompositingLayers);
 
     // When generating the drag image for an element, ignore the document background.
     m_view->setBaseBackgroundColor(Color::transparent);
 
-    // Updating layout can tear everything down, so ref the LocalFrame and Node to keep them alive.
-    RefPtr<LocalFrame> frameProtector(this);
-    RefPtr<Node> nodeProtector(node);
-    m_view->updateLayoutAndStyleForPainting();
-
-    m_view->setNodeToDraw(node); // Enable special sub-tree drawing mode.
+    m_view->setNodeToDraw(&node); // Enable special sub-tree drawing mode.
 
     // Document::updateLayout may have blown away the original RenderObject.
-    RenderObject* renderer = node->renderer();
+    RenderObject* renderer = node.renderer();
     if (!renderer)
         return nullptr;