blink: fix use-after-scope issues in CSSInterpolationType.

third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp

Index: third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp
diff --git a/third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp b/third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp
index 56f5e359f37fd2718294bd0ffc6af5596e641c25..c15db7de439ddc884aa8f714245b961ac1073afd 100644
--- a/third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp
+++ b/third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp
@@ -251,7 +251,8 @@ InterpolationValue CSSInterpolationType::maybeConvertUnderlyingValue(
     return maybeConvertStandardPropertyUnderlyingValue(state);
   }
 
-  const AtomicString& name = getProperty().customPropertyName();
+  const PropertyHandle property = getProperty();

[dgozman, 2017/01/23 20:09:15]

Should we instead make getProperty() return |const PropertyHandle&| and not
create any temporaries?

[krasin1, 2017/01/23 20:13:34]

I suppose it's a question to Alan and other WebKit maintainers. But yes, it
would eliminate the use-after-scope issue (and a possibility to create a new
one)

[alancutter (OOO until 2018), 2017/01/23 22:21:33]

I'm happy to do this along with a host of other similar cleanups in this area of
code, doesn't need to be done in this patch.
This patch must come with a test case however to prevent this problem from
regressing again in future.

[krasin1, 2017/01/23 22:56:01]

ack.

+  const AtomicString& name = property.customPropertyName();
   const PropertyRegistry::Registration* registration =
       getRegistration(state, name);
   if (!registration) {
@@ -302,7 +303,8 @@ void CSSInterpolationType::applyCustomPropertyValue(
   RefPtr<CSSVariableData> variableData = CSSVariableData::create(
       tokenizer.tokenRange(), isAnimationTainted, needsVariableResolution);
   ComputedStyle& style = *state.style();
-  const AtomicString& propertyName = getProperty().customPropertyName();
+  const PropertyHandle property = getProperty();
+  const AtomicString& propertyName = property.customPropertyName();
   const PropertyRegistry::Registration* registration =
       getRegistration(state, propertyName);
   DCHECK(registration);