Move MediaQuery classes off BlinkGC heap

third_party/WebKit/Source/core/dom/StyleElement.cpp

Index: third_party/WebKit/Source/core/dom/StyleElement.cpp
diff --git a/third_party/WebKit/Source/core/dom/StyleElement.cpp b/third_party/WebKit/Source/core/dom/StyleElement.cpp
index c64bf5f3037717af49284bfb19be8ede4d33fd7c..c487bf8c878240da54b97f538d56a64a41e4ec44 100644
--- a/third_party/WebKit/Source/core/dom/StyleElement.cpp
+++ b/third_party/WebKit/Source/core/dom/StyleElement.cpp
@@ -150,11 +150,11 @@ StyleElement::ProcessingResult StyleElement::createSheet(Element& element,
   // If type is empty or CSS, this is a CSS style sheet.
   const AtomicString& type = this->type();
   if (isCSS(element, type) && passesContentSecurityPolicyChecks) {
-    MediaQuerySet* mediaQueries = MediaQuerySet::create(media());
+    RefPtr<MediaQuerySet> mediaQueries = MediaQuerySet::create(media());
 
     MediaQueryEvaluator screenEval("screen");
     MediaQueryEvaluator printEval("print");
-    if (screenEval.eval(mediaQueries) || printEval.eval(mediaQueries)) {
+    if (screenEval.eval(*mediaQueries) || printEval.eval(*mediaQueries)) {
       m_loading = true;
       TextPosition startPosition =
           m_startPosition == TextPosition::belowRangePosition()