Remove PassRefPtr use from the "css" directory, related cleanup
https://bugs.webkit.org/show_bug.cgi?id=166628

Reviewed by Alex Christensen.

* css/CSSCalculationValue.cpp:
(WebCore::CSSCalcBinaryOperation::create): Take RefPtr&& instead of PassRefPtr.
Also added some checks for null. Code here is really inconsistent about null;
probably should change from RefPtr to Ref at some point.
(WebCore::CSSCalcBinaryOperation::createSimplified): Ditto.
(WebCore::CSSCalcBinaryOperation::CSSCalcBinaryOperation): Take Ref&& instead
of PassRefPtr.

* css/CSSCrossfadeValue.cpp:
(WebCore::subimageKnownToBeOpaque): Take a reference instead of a pointer.
(WebCore::CSSCrossfadeValue::SubimageObserver::SubimageObserver): Moved here
from the header, and renamed.
(WebCore::CSSCrossfadeValue::SubimageObserver::imageChanged): Ditto.
(WebCore::CSSCrossfadeValue::CSSCrossfadeValue): Moved here from the header.
(WebCore::CSSCrossfadeValue::create): Ditto.
(WebCore::CSSCrossfadeValue::~CSSCrossfadeValue): Updated for data member name change.
(WebCore::CSSCrossfadeValue::fixedSize): Take a reference. Also rewrote size math to
take advantage of FloatSize multiplication and addition operators.
(WebCore::CSSCrossfadeValue::knownToBeOpaque): Take a reference.
(WebCore::CSSCrossfadeValue::loadSubimages): Set m_subimagesAreReady rather than
calling setReady on the subimage observer.
(WebCore::CSSCrossfadeValue::image): Return a raw pointer rather than a RefPtr.
Take a reference instead of a pointer.
(WebCore::CSSCrossfadeValue::crossfadeChanged): Removed unused rect argument.
Rewrote to use modern for loop.
* css/CSSCrossfadeValue.h: Updated for above changes.

* css/CSSGradientValue.cpp:
(WebCore::createGradient): Added. Helper so the function below can use Ref rather
than RefPtr, and it's also nice to factor out this "poor man's virtual function".
(WebCore::CSSGradientValue::image): Take a reference rather than a pointer.
(WebCore::clone): Added. Helper like createGradient above.
(WebCore::CSSGradientValue::gradientWithStylesResolved): Take a reference rather
than a pointer. Simplified by using the helper above.
(WebCore::CSSGradientValue::knownToBeOpaque): Removed unused argument. Rewrote to
use a modern for loop.
* css/CSSGradientValue.h: Updated for above changes.

* css/CSSImageGeneratorValue.cpp: Moved the CachedGeneratedImage class in here
from the header. Also changed it to use const and Ref.
(WebCore::CSSImageGeneratorValue::addClient): Take a reference rather than a pointer.
(WebCore::CSSImageGeneratorValue::removeClient): Ditto.
(WebCore::CSSImageGeneratorValue::cachedImageForSize): Updated since image now returns
a reference rather than a pointer.
(WebCore::CSSImageGeneratorValue::saveCachedImageForSize): Take a reference rather
than PassRefPtr.
(WebCore::CSSImageGeneratorValue::image): Take a reference rather than a pointer.
(WebCore::CSSImageGeneratorValue::fixedSize): Ditto.
(WebCore::CSSImageGeneratorValue::knownToBeOpaque): Ditto.
* css/CSSImageGeneratorValue.h: Updated for above changes.

* css/CSSValuePool.cpp:
(WebCore::CSSValuePool::createFontFaceValue): Return a RefPtr rather than PassRefPtr.
* css/CSSValuePool.h: Updated for the above.

* css/StyleBuilderConverter.h: Change convertStyleImage and convertShapeValue to
return RefPtr instead of PassRefPtr.

* css/StyleBuilderCustom.h:
(WebCore::StyleBuilderCustom::applyValueContent): Since gradientWithStylesResolved
returns a Ref now, no need to dereference it any more. This also removes reference
count churn since we are now passing a Ref temporary to a Ref&&.
* css/StyleResolver.cpp:
(WebCore::StyleResolver::styleImage): Ditto.

* platform/graphics/GradientImage.cpp:
(WebCore::GradientImage::GradientImage): Pass generator as a reference rather than
as a PassRefPtr.
(WebCore::GradientImage::draw): Updated since m_gradient is now a Ref rather than
a RefPtr.
(WebCore::GradientImage::drawPattern): Ditto.
* platform/graphics/GradientImage.h: Updated for the above changes. Make things
private rather than protected since this class is final.

* rendering/style/StyleGeneratedImage.cpp:
(WebCore::StyleGeneratedImage::imageSize): Pass renderer as a reference. Later, we
should change the interface to this function, too.
(WebCore::StyleGeneratedImage::addClient): Ditto.
(WebCore::StyleGeneratedImage::removeClient): Ditto.
(WebCore::StyleGeneratedImage::image): Ditto.
(WebCore::StyleGeneratedImage::knownToBeOpaque): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@210215 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 2b28c08..9d3b67a 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,92 @@
+2016-12-30  Darin Adler  <darin@apple.com>
+
+        Remove PassRefPtr use from the "css" directory, related cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=166628
+
+        Reviewed by Alex Christensen.
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcBinaryOperation::create): Take RefPtr&& instead of PassRefPtr.
+        Also added some checks for null. Code here is really inconsistent about null;
+        probably should change from RefPtr to Ref at some point.
+        (WebCore::CSSCalcBinaryOperation::createSimplified): Ditto.
+        (WebCore::CSSCalcBinaryOperation::CSSCalcBinaryOperation): Take Ref&& instead
+        of PassRefPtr.
+
+        * css/CSSCrossfadeValue.cpp:
+        (WebCore::subimageKnownToBeOpaque): Take a reference instead of a pointer.
+        (WebCore::CSSCrossfadeValue::SubimageObserver::SubimageObserver): Moved here
+        from the header, and renamed.
+        (WebCore::CSSCrossfadeValue::SubimageObserver::imageChanged): Ditto.
+        (WebCore::CSSCrossfadeValue::CSSCrossfadeValue): Moved here from the header.
+        (WebCore::CSSCrossfadeValue::create): Ditto.
+        (WebCore::CSSCrossfadeValue::~CSSCrossfadeValue): Updated for data member name change.
+        (WebCore::CSSCrossfadeValue::fixedSize): Take a reference. Also rewrote size math to
+        take advantage of FloatSize multiplication and addition operators.
+        (WebCore::CSSCrossfadeValue::knownToBeOpaque): Take a reference.
+        (WebCore::CSSCrossfadeValue::loadSubimages): Set m_subimagesAreReady rather than
+        calling setReady on the subimage observer.
+        (WebCore::CSSCrossfadeValue::image): Return a raw pointer rather than a RefPtr.
+        Take a reference instead of a pointer.
+        (WebCore::CSSCrossfadeValue::crossfadeChanged): Removed unused rect argument.
+        Rewrote to use modern for loop.
+        * css/CSSCrossfadeValue.h: Updated for above changes.
+
+        * css/CSSGradientValue.cpp:
+        (WebCore::createGradient): Added. Helper so the function below can use Ref rather
+        than RefPtr, and it's also nice to factor out this "poor man's virtual function".
+        (WebCore::CSSGradientValue::image): Take a reference rather than a pointer.
+        (WebCore::clone): Added. Helper like createGradient above.
+        (WebCore::CSSGradientValue::gradientWithStylesResolved): Take a reference rather
+        than a pointer. Simplified by using the helper above.
+        (WebCore::CSSGradientValue::knownToBeOpaque): Removed unused argument. Rewrote to
+        use a modern for loop.
+        * css/CSSGradientValue.h: Updated for above changes.
+
+        * css/CSSImageGeneratorValue.cpp: Moved the CachedGeneratedImage class in here
+        from the header. Also changed it to use const and Ref.
+        (WebCore::CSSImageGeneratorValue::addClient): Take a reference rather than a pointer.
+        (WebCore::CSSImageGeneratorValue::removeClient): Ditto.
+        (WebCore::CSSImageGeneratorValue::cachedImageForSize): Updated since image now returns
+        a reference rather than a pointer.
+        (WebCore::CSSImageGeneratorValue::saveCachedImageForSize): Take a reference rather
+        than PassRefPtr.
+        (WebCore::CSSImageGeneratorValue::image): Take a reference rather than a pointer.
+        (WebCore::CSSImageGeneratorValue::fixedSize): Ditto.
+        (WebCore::CSSImageGeneratorValue::knownToBeOpaque): Ditto.
+        * css/CSSImageGeneratorValue.h: Updated for above changes.
+
+        * css/CSSValuePool.cpp:
+        (WebCore::CSSValuePool::createFontFaceValue): Return a RefPtr rather than PassRefPtr.
+        * css/CSSValuePool.h: Updated for the above.
+
+        * css/StyleBuilderConverter.h: Change convertStyleImage and convertShapeValue to
+        return RefPtr instead of PassRefPtr.
+
+        * css/StyleBuilderCustom.h:
+        (WebCore::StyleBuilderCustom::applyValueContent): Since gradientWithStylesResolved
+        returns a Ref now, no need to dereference it any more. This also removes reference
+        count churn since we are now passing a Ref temporary to a Ref&&.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::styleImage): Ditto.
+
+        * platform/graphics/GradientImage.cpp:
+        (WebCore::GradientImage::GradientImage): Pass generator as a reference rather than
+        as a PassRefPtr.
+        (WebCore::GradientImage::draw): Updated since m_gradient is now a Ref rather than
+        a RefPtr.
+        (WebCore::GradientImage::drawPattern): Ditto.
+        * platform/graphics/GradientImage.h: Updated for the above changes. Make things
+        private rather than protected since this class is final.
+
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::imageSize): Pass renderer as a reference. Later, we
+        should change the interface to this function, too.
+        (WebCore::StyleGeneratedImage::addClient): Ditto.
+        (WebCore::StyleGeneratedImage::removeClient): Ditto.
+        (WebCore::StyleGeneratedImage::image): Ditto.
+        (WebCore::StyleGeneratedImage::knownToBeOpaque): Ditto.
+
 2016-12-30  Olivier Blin  <olivier.blin@softathome.com>
 
         [EFL] fix buffer over-read in RenderThemeEfl::mediaControlsStyleSheet()
diff --git a/Source/WebCore/css/CSSCalculationValue.cpp b/Source/WebCore/css/CSSCalculationValue.cpp
index faae3f1..b3111f6 100644
--- a/Source/WebCore/css/CSSCalculationValue.cpp
+++ b/Source/WebCore/css/CSSCalculationValue.cpp
@@ -200,7 +200,7 @@
 
     static RefPtr<CSSCalcPrimitiveValue> create(double value, CSSPrimitiveValue::UnitType type, bool isInteger)
     {
-        if (std::isnan(value) || std::isinf(value))
+        if (!std::isfinite(value))
             return nullptr;
         return adoptRef(new CSSCalcPrimitiveValue(CSSPrimitiveValue::create(value, type), isInteger));
     }
@@ -341,23 +341,27 @@
 class CSSCalcBinaryOperation final : public CSSCalcExpressionNode {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static RefPtr<CSSCalcBinaryOperation> create(CalcOperator op, PassRefPtr<CSSCalcExpressionNode> leftSide, PassRefPtr<CSSCalcExpressionNode> rightSide)
+    static RefPtr<CSSCalcBinaryOperation> create(CalcOperator op, RefPtr<CSSCalcExpressionNode>&& leftSide, RefPtr<CSSCalcExpressionNode>&& rightSide)
     {
+        if (!leftSide || !rightSide)
+            return nullptr;
+
         ASSERT(leftSide->category() < CalcOther);
         ASSERT(rightSide->category() < CalcOther);
 
-        CalculationCategory newCategory = determineCategory(*leftSide, *rightSide, op);
-
+        auto newCategory = determineCategory(*leftSide, *rightSide, op);
         if (newCategory == CalcOther)
             return nullptr;
-
-        return adoptRef(new CSSCalcBinaryOperation(newCategory, op, leftSide, rightSide));
+        return adoptRef(new CSSCalcBinaryOperation(newCategory, op, leftSide.releaseNonNull(), rightSide.releaseNonNull()));
     }
 
-    static RefPtr<CSSCalcExpressionNode> createSimplified(CalcOperator op, PassRefPtr<CSSCalcExpressionNode> leftSide, PassRefPtr<CSSCalcExpressionNode> rightSide)
+    static RefPtr<CSSCalcExpressionNode> createSimplified(CalcOperator op, RefPtr<CSSCalcExpressionNode>&& leftSide, RefPtr<CSSCalcExpressionNode>&& rightSide)
     {
-        CalculationCategory leftCategory = leftSide->category();
-        CalculationCategory rightCategory = rightSide->category();
+        if (!leftSide || !rightSide)
+            return nullptr;
+
+        auto leftCategory = leftSide->category();
+        auto rightCategory = rightSide->category();
         ASSERT(leftCategory < CalcOther);
         ASSERT(rightCategory < CalcOther);
 
@@ -391,25 +395,25 @@
         } else {
             // Simplify multiplying or dividing by a number for simplifiable types.
             ASSERT(op == CalcMultiply || op == CalcDivide);
-            CSSCalcExpressionNode* numberSide = getNumberSide(*leftSide, *rightSide);
+            auto* numberSide = getNumberSide(*leftSide, *rightSide);
             if (!numberSide)
-                return create(op, leftSide, rightSide);
+                return create(op, leftSide.releaseNonNull(), rightSide.releaseNonNull());
             if (numberSide == leftSide && op == CalcDivide)
                 return nullptr;
-            CSSCalcExpressionNode* otherSide = leftSide == numberSide ? rightSide.get() : leftSide.get();
+            auto& otherSide = leftSide == numberSide ? *rightSide : *leftSide;
 
             double number = numberSide->doubleValue();
-            if (std::isnan(number) || std::isinf(number))
+            if (!std::isfinite(number))
                 return nullptr;
             if (op == CalcDivide && !number)
                 return nullptr;
 
-            CSSPrimitiveValue::UnitType otherType = otherSide->primitiveType();
+            auto otherType = otherSide.primitiveType();
             if (hasDoubleValue(otherType))
-                return CSSCalcPrimitiveValue::create(evaluateOperator(op, otherSide->doubleValue(), number), otherType, isInteger);
+                return CSSCalcPrimitiveValue::create(evaluateOperator(op, otherSide.doubleValue(), number), otherType, isInteger);
         }
 
-        return create(op, leftSide, rightSide);
+        return create(op, leftSide.releaseNonNull(), rightSide.releaseNonNull());
     }
 
 private:
@@ -420,10 +424,10 @@
 
     std::unique_ptr<CalcExpressionNode> createCalcExpression(const CSSToLengthConversionData& conversionData) const final
     {
-        std::unique_ptr<CalcExpressionNode> left(m_leftSide->createCalcExpression(conversionData));
+        auto left = m_leftSide->createCalcExpression(conversionData);
         if (!left)
             return nullptr;
-        std::unique_ptr<CalcExpressionNode> right(m_rightSide->createCalcExpression(conversionData));
+        auto right = m_rightSide->createCalcExpression(conversionData);
         if (!right)
             return nullptr;
         return std::make_unique<CalcExpressionBinaryOperation>(WTFMove(left), WTFMove(right), m_operator);
@@ -505,10 +509,10 @@
         return CSSPrimitiveValue::CSS_UNKNOWN;
     }
 
-    CSSCalcBinaryOperation(CalculationCategory category, CalcOperator op, PassRefPtr<CSSCalcExpressionNode> leftSide, PassRefPtr<CSSCalcExpressionNode> rightSide)
-        : CSSCalcExpressionNode(category, isIntegerResult(op, *leftSide, *rightSide))
-        , m_leftSide(leftSide)
-        , m_rightSide(rightSide)
+    CSSCalcBinaryOperation(CalculationCategory category, CalcOperator op, Ref<CSSCalcExpressionNode>&& leftSide, Ref<CSSCalcExpressionNode>&& rightSide)
+        : CSSCalcExpressionNode(category, isIntegerResult(op, leftSide.get(), rightSide.get()))
+        , m_leftSide(WTFMove(leftSide))
+        , m_rightSide(WTFMove(rightSide))
         , m_operator(op)
     {
     }
@@ -632,7 +636,7 @@
             if (!parseValueTerm(tokens, depth, &rhs))
                 return false;
             
-            result->value = CSSCalcBinaryOperation::createSimplified(static_cast<CalcOperator>(operatorCharacter), result->value, rhs.value);
+            result->value = CSSCalcBinaryOperation::createSimplified(static_cast<CalcOperator>(operatorCharacter), WTFMove(result->value), WTFMove(rhs.value));
 
             if (!result->value)
                 return false;
@@ -664,7 +668,7 @@
             if (!parseValueMultiplicativeExpression(tokens, depth, &rhs))
                 return false;
             
-            result->value = CSSCalcBinaryOperation::createSimplified(static_cast<CalcOperator>(operatorCharacter), result->value, rhs.value);
+            result->value = CSSCalcBinaryOperation::createSimplified(static_cast<CalcOperator>(operatorCharacter), WTFMove(result->value), WTFMove(rhs.value));
             if (!result->value)
                 return false;
         }
@@ -689,7 +693,7 @@
     switch (node.type()) {
     case CalcExpressionNodeNumber: {
         float value = toCalcExpressionNumber(node).value();
-        return CSSCalcPrimitiveValue::create(CSSPrimitiveValue::create(value, CSSPrimitiveValue::CSS_NUMBER), value == truncf(value));
+        return CSSCalcPrimitiveValue::create(CSSPrimitiveValue::create(value, CSSPrimitiveValue::CSS_NUMBER), value == std::trunc(value));
     }
     case CalcExpressionNodeLength:
         return createCSS(toCalcExpressionLength(node).length(), style);
@@ -705,9 +709,7 @@
     }
     case CalcExpressionNodeUndefined:
         ASSERT_NOT_REACHED();
-        return nullptr;
     }
-    ASSERT_NOT_REACHED();
     return nullptr;
 }
 
@@ -729,23 +731,22 @@
     case Relative:
     case Undefined:
         ASSERT_NOT_REACHED();
-        return nullptr;
     }
-    ASSERT_NOT_REACHED();
     return nullptr;
 }
 
 RefPtr<CSSCalcValue> CSSCalcValue::create(const CSSParserTokenRange& tokens, ValueRange range)
 {
     CSSCalcExpressionNodeParser parser;
-    RefPtr<CSSCalcExpressionNode> expression = parser.parseCalc(tokens);
-    return expression ? adoptRef(new CSSCalcValue(expression.releaseNonNull(), range != ValueRangeAll)) : nullptr;
-
+    auto expression = parser.parseCalc(tokens);
+    if (!expression)
+        return nullptr;
+    return adoptRef(new CSSCalcValue(expression.releaseNonNull(), range != ValueRangeAll));
 }
     
 RefPtr<CSSCalcValue> CSSCalcValue::create(const CalculationValue& value, const RenderStyle& style)
 {
-    RefPtr<CSSCalcExpressionNode> expression = createCSS(value.expression(), style);
+    auto expression = createCSS(value.expression(), style);
     if (!expression)
         return nullptr;
     return adoptRef(new CSSCalcValue(expression.releaseNonNull(), value.shouldClampToNonNegative()));
diff --git a/Source/WebCore/css/CSSCrossfadeValue.cpp b/Source/WebCore/css/CSSCrossfadeValue.cpp
index 31473d2..c324dc1 100644
--- a/Source/WebCore/css/CSSCrossfadeValue.cpp
+++ b/Source/WebCore/css/CSSCrossfadeValue.cpp
@@ -45,10 +45,10 @@
     return blend(from, to, progress);
 }
 
-static bool subimageKnownToBeOpaque(const CSSValue& value, const RenderElement* renderer)
+static bool subimageKnownToBeOpaque(const CSSValue& value, const RenderElement& renderer)
 {
     if (is<CSSImageValue>(value))
-        return downcast<CSSImageValue>(value).knownToBeOpaque(renderer);
+        return downcast<CSSImageValue>(value).knownToBeOpaque(&renderer);
 
     if (is<CSSImageGeneratorValue>(value))
         return downcast<CSSImageGeneratorValue>(value).knownToBeOpaque(renderer);
@@ -58,12 +58,37 @@
     return false;
 }
 
+inline CSSCrossfadeValue::SubimageObserver::SubimageObserver(CSSCrossfadeValue& owner)
+    : m_owner(owner)
+{
+}
+
+void CSSCrossfadeValue::SubimageObserver::imageChanged(CachedImage*, const IntRect*)
+{
+    m_owner.crossfadeChanged();
+}
+
+inline CSSCrossfadeValue::CSSCrossfadeValue(Ref<CSSValue>&& fromValue, Ref<CSSValue>&& toValue, Ref<CSSPrimitiveValue>&& percentageValue, bool prefixed)
+    : CSSImageGeneratorValue(CrossfadeClass)
+    , m_fromValue(WTFMove(fromValue))
+    , m_toValue(WTFMove(toValue))
+    , m_percentageValue(WTFMove(percentageValue))
+    , m_subimageObserver(*this)
+    , m_isPrefixed(prefixed)
+{
+}
+
+Ref<CSSCrossfadeValue> CSSCrossfadeValue::create(Ref<CSSValue>&& fromValue, Ref<CSSValue>&& toValue, Ref<CSSPrimitiveValue>&& percentageValue, bool prefixed)
+{
+    return adoptRef(*new CSSCrossfadeValue(WTFMove(fromValue), WTFMove(toValue), WTFMove(percentageValue), prefixed));
+}
+
 CSSCrossfadeValue::~CSSCrossfadeValue()
 {
     if (m_cachedFromImage)
-        m_cachedFromImage->removeClient(m_crossfadeSubimageObserver);
+        m_cachedFromImage->removeClient(m_subimageObserver);
     if (m_cachedToImage)
-        m_cachedToImage->removeClient(m_crossfadeSubimageObserver);
+        m_cachedToImage->removeClient(m_subimageObserver);
 }
 
 String CSSCrossfadeValue::customCSSText() const
@@ -82,32 +107,31 @@
     return result.toString();
 }
 
-FloatSize CSSCrossfadeValue::fixedSize(const RenderElement* renderer)
+FloatSize CSSCrossfadeValue::fixedSize(const RenderElement& renderer)
 {
     float percentage = m_percentageValue->floatValue();
     float inversePercentage = 1 - percentage;
 
     // FIXME: Skip Content Security Policy check when cross fade is applied to an element in a user agent shadow tree.
     // See <https://bugs.webkit.org/show_bug.cgi?id=146663>.
-    ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
+    auto options = CachedResourceLoader::defaultCachedResourceOptions();
 
-    CachedResourceLoader& cachedResourceLoader = renderer->document().cachedResourceLoader();
-    CachedImage* cachedFromImage = cachedImageForCSSValue(m_fromValue, cachedResourceLoader, options);
-    CachedImage* cachedToImage = cachedImageForCSSValue(m_toValue, cachedResourceLoader, options);
+    auto& cachedResourceLoader = renderer.document().cachedResourceLoader();
+    auto* cachedFromImage = cachedImageForCSSValue(m_fromValue, cachedResourceLoader, options);
+    auto* cachedToImage = cachedImageForCSSValue(m_toValue, cachedResourceLoader, options);
 
     if (!cachedFromImage || !cachedToImage)
         return FloatSize();
 
-    FloatSize fromImageSize = cachedFromImage->imageForRenderer(renderer)->size();
-    FloatSize toImageSize = cachedToImage->imageForRenderer(renderer)->size();
+    FloatSize fromImageSize = cachedFromImage->imageForRenderer(&renderer)->size();
+    FloatSize toImageSize = cachedToImage->imageForRenderer(&renderer)->size();
 
     // Rounding issues can cause transitions between images of equal size to return
     // a different fixed size; avoid performing the interpolation if the images are the same size.
     if (fromImageSize == toImageSize)
         return fromImageSize;
 
-    return FloatSize(fromImageSize.width() * inversePercentage + toImageSize.width() * percentage,
-        fromImageSize.height() * inversePercentage + toImageSize.height() * percentage);
+    return fromImageSize * inversePercentage + toImageSize * percentage;
 }
 
 bool CSSCrossfadeValue::isPending() const
@@ -116,73 +140,70 @@
         || CSSImageGeneratorValue::subimageIsPending(m_toValue);
 }
 
-bool CSSCrossfadeValue::knownToBeOpaque(const RenderElement* renderer) const
+bool CSSCrossfadeValue::knownToBeOpaque(const RenderElement& renderer) const
 {
-    return subimageKnownToBeOpaque(m_fromValue, renderer) && subimageKnownToBeOpaque(m_toValue, renderer);
+    return subimageKnownToBeOpaque(m_fromValue, renderer)
+        && subimageKnownToBeOpaque(m_toValue, renderer);
 }
 
 void CSSCrossfadeValue::loadSubimages(CachedResourceLoader& cachedResourceLoader, const ResourceLoaderOptions& options)
 {
-    CachedResourceHandle<CachedImage> oldCachedFromImage = m_cachedFromImage;
-    CachedResourceHandle<CachedImage> oldCachedToImage = m_cachedToImage;
+    auto oldCachedFromImage = m_cachedFromImage;
+    auto oldCachedToImage = m_cachedToImage;
 
     m_cachedFromImage = CSSImageGeneratorValue::cachedImageForCSSValue(m_fromValue, cachedResourceLoader, options);
     m_cachedToImage = CSSImageGeneratorValue::cachedImageForCSSValue(m_toValue, cachedResourceLoader, options);
 
     if (m_cachedFromImage != oldCachedFromImage) {
         if (oldCachedFromImage)
-            oldCachedFromImage->removeClient(m_crossfadeSubimageObserver);
+            oldCachedFromImage->removeClient(m_subimageObserver);
         if (m_cachedFromImage)
-            m_cachedFromImage->addClient(m_crossfadeSubimageObserver);
+            m_cachedFromImage->addClient(m_subimageObserver);
     }
 
     if (m_cachedToImage != oldCachedToImage) {
         if (oldCachedToImage)
-            oldCachedToImage->removeClient(m_crossfadeSubimageObserver);
+            oldCachedToImage->removeClient(m_subimageObserver);
         if (m_cachedToImage)
-            m_cachedToImage->addClient(m_crossfadeSubimageObserver);
+            m_cachedToImage->addClient(m_subimageObserver);
     }
 
-    m_crossfadeSubimageObserver.setReady(true);
+    // FIXME: Unclear why this boolean adds any value; for now keeping it around to avoid changing semantics.
+    m_subimagesAreReady = true;
 }
 
-RefPtr<Image> CSSCrossfadeValue::image(RenderElement* renderer, const FloatSize& size)
+Image* CSSCrossfadeValue::image(RenderElement& renderer, const FloatSize& size)
 {
     if (size.isEmpty())
         return nullptr;
 
     // FIXME: Skip Content Security Policy check when cross fade is applied to an element in a user agent shadow tree.
     // See <https://bugs.webkit.org/show_bug.cgi?id=146663>.
-    ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
+    auto options = CachedResourceLoader::defaultCachedResourceOptions();
 
-    CachedResourceLoader& cachedResourceLoader = renderer->document().cachedResourceLoader();
-    CachedImage* cachedFromImage = cachedImageForCSSValue(m_fromValue, cachedResourceLoader, options);
-    CachedImage* cachedToImage = cachedImageForCSSValue(m_toValue, cachedResourceLoader, options);
+    auto& cachedResourceLoader = renderer.document().cachedResourceLoader();
+    auto* cachedFromImage = cachedImageForCSSValue(m_fromValue, cachedResourceLoader, options);
+    auto* cachedToImage = cachedImageForCSSValue(m_toValue, cachedResourceLoader, options);
 
     if (!cachedFromImage || !cachedToImage)
         return Image::nullImage();
 
-    Image* fromImage = cachedFromImage->imageForRenderer(renderer);
-    Image* toImage = cachedToImage->imageForRenderer(renderer);
+    auto* fromImage = cachedFromImage->imageForRenderer(&renderer);
+    auto* toImage = cachedToImage->imageForRenderer(&renderer);
 
     if (!fromImage || !toImage)
         return Image::nullImage();
 
     m_generatedImage = CrossfadeGeneratedImage::create(*fromImage, *toImage, m_percentageValue->floatValue(), fixedSize(renderer), size);
-
-    return m_generatedImage;
+    return m_generatedImage.get();
 }
 
-void CSSCrossfadeValue::crossfadeChanged(const IntRect&)
+inline void CSSCrossfadeValue::crossfadeChanged()
 {
-    for (auto it = clients().begin(), end = clients().end(); it != end; ++it)
-        it->key->imageChanged(static_cast<WrappedImagePtr>(this));
-}
-
-void CSSCrossfadeValue::CrossfadeSubimageObserverProxy::imageChanged(CachedImage*, const IntRect* rect)
-{
-    if (m_ready)
-        m_ownerValue->crossfadeChanged(*rect);
+    if (!m_subimagesAreReady)
+        return;
+    for (auto& client : clients())
+        client.key->imageChanged(this);
 }
 
 bool CSSCrossfadeValue::traverseSubresources(const std::function<bool (const CachedResource&)>& handler) const
@@ -197,8 +218,10 @@
 RefPtr<CSSCrossfadeValue> CSSCrossfadeValue::blend(const CSSCrossfadeValue& from, double progress) const
 {
     ASSERT(equalInputImages(from));
+
     if (!m_cachedToImage || !m_cachedFromImage)
         return nullptr;
+
     auto fromImageValue = CSSImageValue::create(*m_cachedFromImage);
     auto toImageValue = CSSImageValue::create(*m_cachedToImage);
 
diff --git a/Source/WebCore/css/CSSCrossfadeValue.h b/Source/WebCore/css/CSSCrossfadeValue.h
index 4677a65..a3500b4 100644
--- a/Source/WebCore/css/CSSCrossfadeValue.h
+++ b/Source/WebCore/css/CSSCrossfadeValue.h
@@ -28,36 +28,26 @@
 #include "CachedImageClient.h"
 #include "CachedResourceHandle.h"
 #include "CSSImageGeneratorValue.h"
-#include "CSSPrimitiveValue.h"
-#include "Image.h"
-#include "ImageObserver.h"
 
 namespace WebCore {
 
-class CachedImage;
-class CrossfadeSubimageObserverProxy;
-class RenderElement;
-class Document;
+class CSSPrimitiveValue;
 
 class CSSCrossfadeValue final : public CSSImageGeneratorValue {
-    friend class CrossfadeSubimageObserverProxy;
 public:
-    static Ref<CSSCrossfadeValue> create(Ref<CSSValue>&& fromValue, Ref<CSSValue>&& toValue, Ref<CSSPrimitiveValue>&& percentageValue, bool prefixed = false)
-    {
-        return adoptRef(*new CSSCrossfadeValue(WTFMove(fromValue), WTFMove(toValue), WTFMove(percentageValue), prefixed));
-    }
+    static Ref<CSSCrossfadeValue> create(Ref<CSSValue>&& fromValue, Ref<CSSValue>&& toValue, Ref<CSSPrimitiveValue>&& percentageValue, bool prefixed = false);
 
     ~CSSCrossfadeValue();
 
     String customCSSText() const;
 
-    RefPtr<Image> image(RenderElement*, const FloatSize&);
+    Image* image(RenderElement&, const FloatSize&);
     bool isFixedSize() const { return true; }
-    FloatSize fixedSize(const RenderElement*);
+    FloatSize fixedSize(const RenderElement&);
 
     bool isPrefixed() const { return m_isPrefixed; }
     bool isPending() const;
-    bool knownToBeOpaque(const RenderElement*) const;
+    bool knownToBeOpaque(const RenderElement&) const;
 
     void loadSubimages(CachedResourceLoader&, const ResourceLoaderOptions&);
 
@@ -66,37 +56,20 @@
     RefPtr<CSSCrossfadeValue> blend(const CSSCrossfadeValue&, double) const;
 
     bool equals(const CSSCrossfadeValue&) const;
-
     bool equalInputImages(const CSSCrossfadeValue&) const;
 
 private:
-    CSSCrossfadeValue(Ref<CSSValue>&& fromValue, Ref<CSSValue>&& toValue, Ref<CSSPrimitiveValue>&& percentageValue, bool prefixed)
-        : CSSImageGeneratorValue(CrossfadeClass)
-        , m_fromValue(WTFMove(fromValue))
-        , m_toValue(WTFMove(toValue))
-        , m_percentageValue(WTFMove(percentageValue))
-        , m_crossfadeSubimageObserver(this)
-        , m_isPrefixed(prefixed)
-    {
-    }
+    CSSCrossfadeValue(Ref<CSSValue>&& fromValue, Ref<CSSValue>&& toValue, Ref<CSSPrimitiveValue>&& percentageValue, bool prefixed);
 
-    class CrossfadeSubimageObserverProxy final : public CachedImageClient {
+    class SubimageObserver final : public CachedImageClient {
     public:
-        CrossfadeSubimageObserverProxy(CSSCrossfadeValue* ownerValue)
-            : m_ownerValue(ownerValue)
-            , m_ready(false)
-        {
-        }
-
-        virtual ~CrossfadeSubimageObserverProxy() { }
-        void imageChanged(CachedImage*, const IntRect* = nullptr) final;
-        void setReady(bool ready) { m_ready = ready; }
+        SubimageObserver(CSSCrossfadeValue&);
     private:
-        CSSCrossfadeValue* m_ownerValue;
-        bool m_ready;
+        void imageChanged(CachedImage*, const IntRect*) final;
+        CSSCrossfadeValue& m_owner;
     };
 
-    void crossfadeChanged(const IntRect&);
+    void crossfadeChanged();
 
     Ref<CSSValue> m_fromValue;
     Ref<CSSValue> m_toValue;
@@ -107,8 +80,9 @@
 
     RefPtr<Image> m_generatedImage;
 
-    CrossfadeSubimageObserverProxy m_crossfadeSubimageObserver;
+    SubimageObserver m_subimageObserver;
     bool m_isPrefixed { false };
+    bool m_subimagesAreReady { false };
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSGradientValue.cpp b/Source/WebCore/css/CSSGradientValue.cpp
index 5eb83ff..95b2047 100644
--- a/Source/WebCore/css/CSSGradientValue.cpp
+++ b/Source/WebCore/css/CSSGradientValue.cpp
@@ -30,47 +30,39 @@
 #include "CSSToLengthConversionData.h"
 #include "CSSValueKeywords.h"
 #include "FloatSize.h"
-#include "FloatSizeHash.h"
 #include "Gradient.h"
 #include "GradientImage.h"
-#include "Image.h"
 #include "NodeRenderStyle.h"
 #include "Pair.h"
 #include "RenderElement.h"
 #include "RenderView.h"
 #include "StyleResolver.h"
 #include <wtf/text/StringBuilder.h>
-#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
-RefPtr<Image> CSSGradientValue::image(RenderElement* renderer, const FloatSize& size)
+static inline Ref<Gradient> createGradient(CSSGradientValue& value, RenderElement& renderer, FloatSize size)
+{
+    if (is<CSSLinearGradientValue>(value))
+        return downcast<CSSLinearGradientValue>(value).createGradient(renderer, size);
+    return downcast<CSSRadialGradientValue>(value).createGradient(renderer, size);
+}
+
+RefPtr<Image> CSSGradientValue::image(RenderElement& renderer, const FloatSize& size)
 {
     if (size.isEmpty())
         return nullptr;
-
     bool cacheable = isCacheable();
     if (cacheable) {
-        if (!clients().contains(renderer))
+        if (!clients().contains(&renderer))
             return nullptr;
-
-        Image* result = cachedImageForSize(size);
-        if (result)
+        if (auto* result = cachedImageForSize(size))
             return result;
     }
-
-    RefPtr<Gradient> gradient;
-
-    if (is<CSSLinearGradientValue>(*this))
-        gradient = downcast<CSSLinearGradientValue>(*this).createGradient(*renderer, size);
-    else
-        gradient = downcast<CSSRadialGradientValue>(*this).createGradient(*renderer, size);
-
-    RefPtr<GradientImage> newImage = GradientImage::create(gradient, size);
+    auto newImage = GradientImage::create(createGradient(*this, renderer, size), size);
     if (cacheable)
-        saveCachedImageForSize(size, newImage);
-
-    return newImage;
+        saveCachedImageForSize(size, newImage.get());
+    return WTFMove(newImage);
 }
 
 // Should only ever be called for deprecated gradients.
@@ -94,45 +86,34 @@
 
 struct GradientStop {
     Color color;
-    float offset;
-    bool specified;
-    bool isMidpoint;
-
-    GradientStop()
-        : offset(0)
-        , specified(false)
-        , isMidpoint(false)
-    { }
+    float offset { 0 };
+    bool specified { false };
+    bool isMidpoint { false };
 };
 
-RefPtr<CSSGradientValue> CSSGradientValue::gradientWithStylesResolved(const StyleResolver* styleResolver)
+static inline Ref<CSSGradientValue> clone(CSSGradientValue& value)
 {
-    bool derived = false;
+    if (is<CSSLinearGradientValue>(value))
+        return downcast<CSSLinearGradientValue>(value).clone();
+    ASSERT(is<CSSRadialGradientValue>(value));
+    return downcast<CSSRadialGradientValue>(value).clone();
+}
+
+Ref<CSSGradientValue> CSSGradientValue::gradientWithStylesResolved(const StyleResolver& styleResolver)
+{
+    bool colorIsDerivedFromElement = false;
     for (auto& stop : m_stops) {
-        if (!stop.isMidpoint && styleResolver->colorFromPrimitiveValueIsDerivedFromElement(*stop.m_color)) {
+        if (!stop.isMidpoint && styleResolver.colorFromPrimitiveValueIsDerivedFromElement(*stop.m_color)) {
             stop.m_colorIsDerivedFromElement = true;
-            derived = true;
+            colorIsDerivedFromElement = true;
             break;
         }
     }
-
-    RefPtr<CSSGradientValue> result;
-    if (!derived)
-        result = this;
-    else if (is<CSSLinearGradientValue>(*this))
-        result = downcast<CSSLinearGradientValue>(*this).clone();
-    else if (is<CSSRadialGradientValue>(*this))
-        result = downcast<CSSRadialGradientValue>(*this).clone();
-    else {
-        ASSERT_NOT_REACHED();
-        return nullptr;
-    }
-
+    auto result = colorIsDerivedFromElement ? clone(*this) : makeRef(*this);
     for (auto& stop : result->m_stops) {
         if (!stop.isMidpoint)
-            stop.m_resolvedColor = styleResolver->colorFromPrimitiveValue(*stop.m_color);
+            stop.m_resolvedColor = styleResolver.colorFromPrimitiveValue(*stop.m_color);
     }
-
     return result;
 }
 
@@ -579,10 +560,10 @@
     return true;
 }
 
-bool CSSGradientValue::knownToBeOpaque(const RenderElement*) const
+bool CSSGradientValue::knownToBeOpaque() const
 {
-    for (size_t i = 0; i < m_stops.size(); ++i) {
-        if (!m_stops[i].m_resolvedColor.isOpaque())
+    for (auto& stop : m_stops) {
+        if (!stop.m_resolvedColor.isOpaque())
             return false;
     }
     return true;
diff --git a/Source/WebCore/css/CSSGradientValue.h b/Source/WebCore/css/CSSGradientValue.h
index 17e196d..a8e66c4 100644
--- a/Source/WebCore/css/CSSGradientValue.h
+++ b/Source/WebCore/css/CSSGradientValue.h
@@ -27,14 +27,13 @@
 
 #include "CSSImageGeneratorValue.h"
 #include "CSSPrimitiveValue.h"
-#include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
 class FloatPoint;
 class Gradient;
-class RenderView;
+class StyleResolver;
 
 enum CSSGradientType {
     CSSDeprecatedLinearGradient,
@@ -61,7 +60,7 @@
 
 class CSSGradientValue : public CSSImageGeneratorValue {
 public:
-    RefPtr<Image> image(RenderElement*, const FloatSize&);
+    RefPtr<Image> image(RenderElement&, const FloatSize&);
 
     void setFirstX(RefPtr<CSSPrimitiveValue>&& val) { m_firstX = WTFMove(val); }
     void setFirstY(RefPtr<CSSPrimitiveValue>&& val) { m_firstY = WTFMove(val); }
@@ -79,13 +78,13 @@
     CSSGradientType gradientType() const { return m_gradientType; }
 
     bool isFixedSize() const { return false; }
-    FloatSize fixedSize(const RenderElement*) const { return FloatSize(); }
+    FloatSize fixedSize(const RenderElement&) const { return FloatSize(); }
 
     bool isPending() const { return false; }
-    bool knownToBeOpaque(const RenderElement*) const;
+    bool knownToBeOpaque() const;
 
     void loadSubimages(CachedResourceLoader&, const ResourceLoaderOptions&) { }
-    RefPtr<CSSGradientValue> gradientWithStylesResolved(const StyleResolver*);
+    Ref<CSSGradientValue> gradientWithStylesResolved(const StyleResolver&);
 
 protected:
     CSSGradientValue(ClassType classType, CSSGradientRepeat repeat, CSSGradientType gradientType)
@@ -132,7 +131,6 @@
 
 class CSSLinearGradientValue final : public CSSGradientValue {
 public:
-
     static Ref<CSSLinearGradientValue> create(CSSGradientRepeat repeat, CSSGradientType gradientType = CSSLinearGradient)
     {
         return adoptRef(*new CSSLinearGradientValue(repeat, gradientType));
@@ -212,7 +210,6 @@
     {
     }
 
-
     // Resolve points/radii to front end values.
     float resolveRadius(CSSPrimitiveValue&, const CSSToLengthConversionData&, float* widthOrHeight = 0);
 
diff --git a/Source/WebCore/css/CSSImageGeneratorValue.cpp b/Source/WebCore/css/CSSImageGeneratorValue.cpp
index a75283a..c8b6155 100644
--- a/Source/WebCore/css/CSSImageGeneratorValue.cpp
+++ b/Source/WebCore/css/CSSImageGeneratorValue.cpp
@@ -41,6 +41,22 @@
 
 static const auto timeToKeepCachedGeneratedImages = std::chrono::seconds { 3 };
 
+class CSSImageGeneratorValue::CachedGeneratedImage {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    CachedGeneratedImage(CSSImageGeneratorValue&, FloatSize, GeneratedImage&);
+    GeneratedImage& image() const { return const_cast<GeneratedImage&>(m_image.get()); }
+    void puntEvictionTimer() { m_evictionTimer.restart(); }
+
+private:
+    void evictionTimerFired();
+
+    CSSImageGeneratorValue& m_owner;
+    const FloatSize m_size;
+    const Ref<GeneratedImage> m_image;
+    DeferrableOneShotTimer m_evictionTimer;
+};
+
 CSSImageGeneratorValue::CSSImageGeneratorValue(ClassType classType)
     : CSSValue(classType)
 {
@@ -50,19 +66,17 @@
 {
 }
 
-void CSSImageGeneratorValue::addClient(RenderElement* renderer)
+void CSSImageGeneratorValue::addClient(RenderElement& renderer)
 {
-    ASSERT(renderer);
     if (m_clients.isEmpty())
         ref();
-    m_clients.add(renderer);
+    m_clients.add(&renderer);
 }
 
-void CSSImageGeneratorValue::removeClient(RenderElement* renderer)
+void CSSImageGeneratorValue::removeClient(RenderElement& renderer)
 {
-    ASSERT(renderer);
-    ASSERT(m_clients.contains(renderer));
-    if (m_clients.remove(renderer) && m_clients.isEmpty())
+    ASSERT(m_clients.contains(&renderer));
+    if (m_clients.remove(&renderer) && m_clients.isEmpty())
         deref();
 }
 
@@ -71,15 +85,15 @@
     if (size.isEmpty())
         return nullptr;
 
-    CachedGeneratedImage* cachedGeneratedImage = m_images.get(size);
+    auto* cachedGeneratedImage = m_images.get(size);
     if (!cachedGeneratedImage)
         return nullptr;
 
     cachedGeneratedImage->puntEvictionTimer();
-    return cachedGeneratedImage->image();
+    return &cachedGeneratedImage->image();
 }
 
-void CSSImageGeneratorValue::saveCachedImageForSize(FloatSize size, PassRefPtr<GeneratedImage> image)
+void CSSImageGeneratorValue::saveCachedImageForSize(FloatSize size, GeneratedImage& image)
 {
     ASSERT(!m_images.contains(size));
     m_images.add(size, std::make_unique<CachedGeneratedImage>(*this, size, image));
@@ -91,7 +105,7 @@
     m_images.remove(size);
 }
 
-CSSImageGeneratorValue::CachedGeneratedImage::CachedGeneratedImage(CSSImageGeneratorValue& owner, FloatSize size, PassRefPtr<GeneratedImage> image)
+inline CSSImageGeneratorValue::CachedGeneratedImage::CachedGeneratedImage(CSSImageGeneratorValue& owner, FloatSize size, GeneratedImage& image)
     : m_owner(owner)
     , m_size(size)
     , m_image(image)
@@ -106,17 +120,17 @@
     m_owner.evictCachedGeneratedImage(m_size);
 }
 
-RefPtr<Image> CSSImageGeneratorValue::image(RenderElement* renderer, const FloatSize& size)
+RefPtr<Image> CSSImageGeneratorValue::image(RenderElement& renderer, const FloatSize& size)
 {
     switch (classType()) {
     case CanvasClass:
-        return downcast<CSSCanvasValue>(*this).image(renderer, size);
+        return downcast<CSSCanvasValue>(*this).image(&renderer, size);
     case NamedImageClass:
-        return downcast<CSSNamedImageValue>(*this).image(renderer, size);
+        return downcast<CSSNamedImageValue>(*this).image(&renderer, size);
     case CrossfadeClass:
         return downcast<CSSCrossfadeValue>(*this).image(renderer, size);
     case FilterImageClass:
-        return downcast<CSSFilterImageValue>(*this).image(renderer, size);
+        return downcast<CSSFilterImageValue>(*this).image(&renderer, size);
     case LinearGradientClass:
         return downcast<CSSLinearGradientValue>(*this).image(renderer, size);
     case RadialGradientClass:
@@ -148,15 +162,15 @@
     return false;
 }
 
-FloatSize CSSImageGeneratorValue::fixedSize(const RenderElement* renderer)
+FloatSize CSSImageGeneratorValue::fixedSize(const RenderElement& renderer)
 {
     switch (classType()) {
     case CanvasClass:
-        return downcast<CSSCanvasValue>(*this).fixedSize(renderer);
+        return downcast<CSSCanvasValue>(*this).fixedSize(&renderer);
     case CrossfadeClass:
         return downcast<CSSCrossfadeValue>(*this).fixedSize(renderer);
     case FilterImageClass:
-        return downcast<CSSFilterImageValue>(*this).fixedSize(renderer);
+        return downcast<CSSFilterImageValue>(*this).fixedSize(&renderer);
     case LinearGradientClass:
         return downcast<CSSLinearGradientValue>(*this).fixedSize(renderer);
     case RadialGradientClass:
@@ -188,7 +202,7 @@
     return false;
 }
 
-bool CSSImageGeneratorValue::knownToBeOpaque(const RenderElement* renderer) const
+bool CSSImageGeneratorValue::knownToBeOpaque(const RenderElement& renderer) const
 {
     switch (classType()) {
     case CrossfadeClass:
@@ -198,11 +212,11 @@
     case NamedImageClass:
         return false;
     case FilterImageClass:
-        return downcast<CSSFilterImageValue>(*this).knownToBeOpaque(renderer);
+        return downcast<CSSFilterImageValue>(*this).knownToBeOpaque(&renderer);
     case LinearGradientClass:
-        return downcast<CSSLinearGradientValue>(*this).knownToBeOpaque(renderer);
+        return downcast<CSSLinearGradientValue>(*this).knownToBeOpaque();
     case RadialGradientClass:
-        return downcast<CSSRadialGradientValue>(*this).knownToBeOpaque(renderer);
+        return downcast<CSSRadialGradientValue>(*this).knownToBeOpaque();
     default:
         ASSERT_NOT_REACHED();
     }
@@ -244,7 +258,6 @@
         return false;
 
     ASSERT_NOT_REACHED();
-    
     return false;
 }
 
@@ -265,7 +278,7 @@
         return nullptr;
 
     ASSERT_NOT_REACHED();
-    
     return nullptr;
 }
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSImageGeneratorValue.h b/Source/WebCore/css/CSSImageGeneratorValue.h
index 5cc464e..dc57ea4 100644
--- a/Source/WebCore/css/CSSImageGeneratorValue.h
+++ b/Source/WebCore/css/CSSImageGeneratorValue.h
@@ -26,7 +26,6 @@
 #pragma once
 
 #include "CSSValue.h"
-#include "FloatSize.h"
 #include "FloatSizeHash.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
@@ -38,23 +37,23 @@
 class GeneratedImage;
 class Image;
 class RenderElement;
-class StyleResolver;
+
 struct ResourceLoaderOptions;
 
 class CSSImageGeneratorValue : public CSSValue {
 public:
     ~CSSImageGeneratorValue();
 
-    void addClient(RenderElement*);
-    void removeClient(RenderElement*);
+    void addClient(RenderElement&);
+    void removeClient(RenderElement&);
 
-    RefPtr<Image> image(RenderElement*, const FloatSize&);
+    RefPtr<Image> image(RenderElement&, const FloatSize&);
 
     bool isFixedSize() const;
-    FloatSize fixedSize(const RenderElement*);
+    FloatSize fixedSize(const RenderElement&);
 
     bool isPending() const;
-    bool knownToBeOpaque(const RenderElement*) const;
+    bool knownToBeOpaque(const RenderElement&) const;
 
     void loadSubimages(CachedResourceLoader&, const ResourceLoaderOptions&);
 
@@ -62,7 +61,7 @@
     CSSImageGeneratorValue(ClassType);
 
     GeneratedImage* cachedImageForSize(FloatSize);
-    void saveCachedImageForSize(FloatSize, PassRefPtr<GeneratedImage>);
+    void saveCachedImageForSize(FloatSize, GeneratedImage&);
     const HashCountedSet<RenderElement*>& clients() const { return m_clients; }
 
     // Helper functions for Crossfade and Filter.
@@ -70,23 +69,8 @@
     static bool subimageIsPending(const CSSValue&);
 
 private:
-    class CachedGeneratedImage {
-        WTF_MAKE_FAST_ALLOCATED;
-    public:
-        CachedGeneratedImage(CSSImageGeneratorValue&, FloatSize, PassRefPtr<GeneratedImage>);
-        GeneratedImage* image() { return m_image.get(); }
-        void puntEvictionTimer() { m_evictionTimer.restart(); }
+    class CachedGeneratedImage;
 
-    private:
-        void evictionTimerFired();
-
-        CSSImageGeneratorValue& m_owner;
-        FloatSize m_size;
-        RefPtr<GeneratedImage> m_image;
-        DeferrableOneShotTimer m_evictionTimer;
-    };
-
-    friend class CachedGeneratedImage;
     void evictCachedGeneratedImage(FloatSize);
 
     HashCountedSet<RenderElement*> m_clients;
diff --git a/Source/WebCore/css/CSSValuePool.cpp b/Source/WebCore/css/CSSValuePool.cpp
index e67f4e2..6f424c3 100644
--- a/Source/WebCore/css/CSSValuePool.cpp
+++ b/Source/WebCore/css/CSSValuePool.cpp
@@ -132,7 +132,7 @@
     return *value;
 }
 
-PassRefPtr<CSSValueList> CSSValuePool::createFontFaceValue(const AtomicString& string)
+RefPtr<CSSValueList> CSSValuePool::createFontFaceValue(const AtomicString& string)
 {
     // Remove one entry at random if the cache grows too large.
     const int maximumFontFaceCacheSize = 128;
diff --git a/Source/WebCore/css/CSSValuePool.h b/Source/WebCore/css/CSSValuePool.h
index a4259ec..c5d2d8b 100644
--- a/Source/WebCore/css/CSSValuePool.h
+++ b/Source/WebCore/css/CSSValuePool.h
@@ -51,7 +51,7 @@
 public:
     static CSSValuePool& singleton();
 
-    PassRefPtr<CSSValueList> createFontFaceValue(const AtomicString&);
+    RefPtr<CSSValueList> createFontFaceValue(const AtomicString&);
     Ref<CSSPrimitiveValue> createFontFamilyValue(const String&, FromSystemFontID = FromSystemFontID::No);
     Ref<CSSInheritedValue> createInheritedValue() { return m_inheritedValue.get(); }
     Ref<CSSInitialValue> createImplicitInitialValue() { return m_implicitInitialValue.get(); }
diff --git a/Source/WebCore/css/StyleBuilderConverter.h b/Source/WebCore/css/StyleBuilderConverter.h
index 640049a..de8fe19 100644
--- a/Source/WebCore/css/StyleBuilderConverter.h
+++ b/Source/WebCore/css/StyleBuilderConverter.h
@@ -62,18 +62,18 @@
     static Length convertLengthOrAuto(StyleResolver&, const CSSValue&);
     static Length convertLengthSizing(StyleResolver&, const CSSValue&);
     static Length convertLengthMaxSizing(StyleResolver&, const CSSValue&);
-    template <typename T> static T convertComputedLength(StyleResolver&, const CSSValue&);
-    template <typename T> static T convertLineWidth(StyleResolver&, const CSSValue&);
+    template<typename T> static T convertComputedLength(StyleResolver&, const CSSValue&);
+    template<typename T> static T convertLineWidth(StyleResolver&, const CSSValue&);
     static float convertSpacing(StyleResolver&, const CSSValue&);
     static LengthSize convertRadius(StyleResolver&, const CSSValue&);
     static LengthPoint convertObjectPosition(StyleResolver&, const CSSValue&);
     static TextDecoration convertTextDecoration(StyleResolver&, const CSSValue&);
-    template <typename T> static T convertNumber(StyleResolver&, const CSSValue&);
-    template <typename T> static T convertNumberOrAuto(StyleResolver&, const CSSValue&);
+    template<typename T> static T convertNumber(StyleResolver&, const CSSValue&);
+    template<typename T> static T convertNumberOrAuto(StyleResolver&, const CSSValue&);
     static short convertWebkitHyphenateLimitLines(StyleResolver&, const CSSValue&);
-    template <CSSPropertyID property> static NinePieceImage convertBorderImage(StyleResolver&, CSSValue&);
-    template <CSSPropertyID property> static NinePieceImage convertBorderMask(StyleResolver&, CSSValue&);
-    template <CSSPropertyID property> static PassRefPtr<StyleImage> convertStyleImage(StyleResolver&, CSSValue&);
+    template<CSSPropertyID> static NinePieceImage convertBorderImage(StyleResolver&, CSSValue&);
+    template<CSSPropertyID> static NinePieceImage convertBorderMask(StyleResolver&, CSSValue&);
+    template<CSSPropertyID> static RefPtr<StyleImage> convertStyleImage(StyleResolver&, CSSValue&);
     static TransformOperations convertTransform(StyleResolver&, const CSSValue&);
     static String convertString(StyleResolver&, const CSSValue&);
     static String convertStringOrAuto(StyleResolver&, const CSSValue&);
@@ -91,7 +91,7 @@
     static float convertTextStrokeWidth(StyleResolver&, const CSSValue&);
     static LineBoxContain convertLineBoxContain(StyleResolver&, const CSSValue&);
     static TextDecorationSkip convertTextDecorationSkip(StyleResolver&, const CSSValue&);
-    static PassRefPtr<ShapeValue> convertShapeValue(StyleResolver&, CSSValue&);
+    static RefPtr<ShapeValue> convertShapeValue(StyleResolver&, CSSValue&);
 #if ENABLE(CSS_SCROLL_SNAP)
     static ScrollSnapType convertScrollSnapType(StyleResolver&, const CSSValue&);
     static ScrollSnapAlign convertScrollSnapAlign(StyleResolver&, const CSSValue&);
@@ -234,13 +234,13 @@
     return convertLengthSizing(styleResolver, value);
 }
 
-template <typename T>
+template<typename T>
 inline T StyleBuilderConverter::convertComputedLength(StyleResolver& styleResolver, const CSSValue& value)
 {
     return downcast<CSSPrimitiveValue>(value).computeLength<T>(styleResolver.state().cssToLengthConversionData());
 }
 
-template <typename T>
+template<typename T>
 inline T StyleBuilderConverter::convertLineWidth(StyleResolver& styleResolver, const CSSValue& value)
 {
     auto& primitiveValue = downcast<CSSPrimitiveValue>(value);
@@ -333,7 +333,7 @@
     return convertPositionComponent<CSSValueTop, CSSValueBottom>(styleResolver, downcast<CSSPrimitiveValue>(value));
 }
 
-template <CSSValueID cssValueFor0, CSSValueID cssValueFor100>
+template<CSSValueID cssValueFor0, CSSValueID cssValueFor100>
 inline Length StyleBuilderConverter::convertPositionComponent(StyleResolver& styleResolver, const CSSPrimitiveValue& value)
 {
     Length length;
@@ -392,13 +392,13 @@
     return result;
 }
 
-template <typename T>
+template<typename T>
 inline T StyleBuilderConverter::convertNumber(StyleResolver&, const CSSValue& value)
 {
     return downcast<CSSPrimitiveValue>(value).value<T>(CSSPrimitiveValue::CSS_NUMBER);
 }
 
-template <typename T>
+template<typename T>
 inline T StyleBuilderConverter::convertNumberOrAuto(StyleResolver& styleResolver, const CSSValue& value)
 {
     if (downcast<CSSPrimitiveValue>(value).valueID() == CSSValueAuto)
@@ -414,7 +414,7 @@
     return primitiveValue.value<short>(CSSPrimitiveValue::CSS_NUMBER);
 }
 
-template <CSSPropertyID property>
+template<CSSPropertyID property>
 inline NinePieceImage StyleBuilderConverter::convertBorderImage(StyleResolver& styleResolver, CSSValue& value)
 {
     NinePieceImage image;
@@ -422,7 +422,7 @@
     return image;
 }
 
-template <CSSPropertyID property>
+template<CSSPropertyID property>
 inline NinePieceImage StyleBuilderConverter::convertBorderMask(StyleResolver& styleResolver, CSSValue& value)
 {
     NinePieceImage image;
@@ -431,8 +431,8 @@
     return image;
 }
 
-template <CSSPropertyID property>
-inline PassRefPtr<StyleImage> StyleBuilderConverter::convertStyleImage(StyleResolver& styleResolver, CSSValue& value)
+template<CSSPropertyID>
+inline RefPtr<StyleImage> StyleBuilderConverter::convertStyleImage(StyleResolver& styleResolver, CSSValue& value)
 {
     return styleResolver.styleImage(value);
 }
@@ -758,7 +758,7 @@
     return is<CSSImageValue>(value) || is<CSSImageSetValue>(value) || is<CSSImageGeneratorValue>(value);
 }
 
-inline PassRefPtr<ShapeValue> StyleBuilderConverter::convertShapeValue(StyleResolver& styleResolver, CSSValue& value)
+inline RefPtr<ShapeValue> StyleBuilderConverter::convertShapeValue(StyleResolver& styleResolver, CSSValue& value)
 {
     if (is<CSSPrimitiveValue>(value)) {
         ASSERT(downcast<CSSPrimitiveValue>(value).valueID() == CSSValueNone);
@@ -771,7 +771,7 @@
     RefPtr<BasicShape> shape;
     CSSBoxType referenceBox = BoxMissing;
     for (auto& currentValue : downcast<CSSValueList>(value)) {
-        CSSPrimitiveValue& primitiveValue = downcast<CSSPrimitiveValue>(currentValue.get());
+        auto& primitiveValue = downcast<CSSPrimitiveValue>(currentValue.get());
         if (primitiveValue.isShape())
             shape = basicShapeForValue(styleResolver.state().cssToLengthConversionData(), *primitiveValue.shapeValue());
         else if (primitiveValue.valueID() == CSSValueContentBox
diff --git a/Source/WebCore/css/StyleBuilderCustom.h b/Source/WebCore/css/StyleBuilderCustom.h
index cf1e843..0ffd9d4 100644
--- a/Source/WebCore/css/StyleBuilderCustom.h
+++ b/Source/WebCore/css/StyleBuilderCustom.h
@@ -1361,7 +1361,7 @@
     for (auto& item : downcast<CSSValueList>(value)) {
         if (is<CSSImageGeneratorValue>(item.get())) {
             if (is<CSSGradientValue>(item.get()))
-                styleResolver.style()->setContent(StyleGeneratedImage::create(*downcast<CSSGradientValue>(item.get()).gradientWithStylesResolved(&styleResolver)), didSet);
+                styleResolver.style()->setContent(StyleGeneratedImage::create(downcast<CSSGradientValue>(item.get()).gradientWithStylesResolved(styleResolver)), didSet);
             else
                 styleResolver.style()->setContent(StyleGeneratedImage::create(downcast<CSSImageGeneratorValue>(item.get())), didSet);
             didSet = true;
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index 2a4c5e4..00469ee7 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -1689,7 +1689,7 @@
 {
     if (is<CSSImageGeneratorValue>(value)) {
         if (is<CSSGradientValue>(value))
-            return StyleGeneratedImage::create(*downcast<CSSGradientValue>(value).gradientWithStylesResolved(this));
+            return StyleGeneratedImage::create(downcast<CSSGradientValue>(value).gradientWithStylesResolved(*this));
 
         if (is<CSSFilterImageValue>(value)) {
             // FilterImage needs to calculate FilterOperations.
diff --git a/Source/WebCore/platform/graphics/GradientImage.cpp b/Source/WebCore/platform/graphics/GradientImage.cpp
index d619893..50b9d77 100644
--- a/Source/WebCore/platform/graphics/GradientImage.cpp
+++ b/Source/WebCore/platform/graphics/GradientImage.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,15 +26,12 @@
 #include "config.h"
 #include "GradientImage.h"
 
-#include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
-#include "Length.h"
-#include "TextStream.h"
 
 namespace WebCore {
 
-GradientImage::GradientImage(PassRefPtr<Gradient> generator, const FloatSize& size)
+GradientImage::GradientImage(Gradient& generator, const FloatSize& size)
     : m_gradient(generator)
 {
     setContainerSize(size);
@@ -53,7 +50,7 @@
     if (destRect.size() != srcRect.size())
         destContext.scale(FloatSize(destRect.width() / srcRect.width(), destRect.height() / srcRect.height()));
     destContext.translate(-srcRect.x(), -srcRect.y());
-    destContext.fillRect(FloatRect(FloatPoint(), size()), *m_gradient.get());
+    destContext.fillRect(FloatRect(FloatPoint(), size()), m_gradient.get());
 }
 
 void GradientImage::drawPattern(GraphicsContext& destContext, const FloatRect& destRect, const FloatRect& srcRect, const AffineTransform& patternTransform,
@@ -80,7 +77,7 @@
             return;
 
         // Fill with the generated image.
-        m_cachedImageBuffer->context().fillRect(FloatRect(FloatPoint(), adjustedSize), *m_gradient);
+        m_cachedImageBuffer->context().fillRect(FloatRect(FloatPoint(), adjustedSize), m_gradient.get());
 
         m_cachedGeneratorHash = generatorHash;
         m_cachedAdjustedSize = adjustedSize;
diff --git a/Source/WebCore/platform/graphics/GradientImage.h b/Source/WebCore/platform/graphics/GradientImage.h
index d2ceb26..c494639 100644
--- a/Source/WebCore/platform/graphics/GradientImage.h
+++ b/Source/WebCore/platform/graphics/GradientImage.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2012, 2013 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,45 +23,36 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef GradientImage_h
-#define GradientImage_h
+#pragma once
 
-#include "FloatSize.h"
 #include "GeneratedImage.h"
-#include "Gradient.h"
-#include "Image.h"
-#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
+class Gradient;
 class ImageBuffer;
 
 class GradientImage final : public GeneratedImage {
 public:
-    static PassRefPtr<GradientImage> create(PassRefPtr<Gradient> generator, const FloatSize& size)
+    static Ref<GradientImage> create(Gradient& generator, const FloatSize& size)
     {
-        return adoptRef(new GradientImage(generator, size));
+        return adoptRef(*new GradientImage(generator, size));
     }
 
     virtual ~GradientImage();
 
-protected:
-    void draw(GraphicsContext&, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator, BlendMode, ImageOrientationDescription) override;
-    void drawPattern(GraphicsContext&, const FloatRect& destRect, const FloatRect& srcRect, const AffineTransform& patternTransform,
-        const FloatPoint& phase, const FloatSize& spacing, CompositeOperator, BlendMode) override;
-
-    GradientImage(PassRefPtr<Gradient>, const FloatSize&);
-
 private:
-    bool isGradientImage() const override { return true; }
-    void dump(TextStream&) const override;
+    GradientImage(Gradient&, const FloatSize&);
+
+    void draw(GraphicsContext&, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator, BlendMode, ImageOrientationDescription) final;
+    void drawPattern(GraphicsContext&, const FloatRect& destRect, const FloatRect& srcRect, const AffineTransform& patternTransform, const FloatPoint& phase, const FloatSize& spacing, CompositeOperator, BlendMode) final;
+    bool isGradientImage() const final { return true; }
+    void dump(TextStream&) const final;
     
-    RefPtr<Gradient> m_gradient;
+    Ref<Gradient> m_gradient;
     std::unique_ptr<ImageBuffer> m_cachedImageBuffer;
     FloatSize m_cachedAdjustedSize;
     unsigned m_cachedGeneratorHash;
 };
 
 }
-
-#endif
diff --git a/Source/WebCore/rendering/style/StyleGeneratedImage.cpp b/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
index b071f8f..2c84b2f 100644
--- a/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
+++ b/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
@@ -54,8 +54,9 @@
 
 FloatSize StyleGeneratedImage::imageSize(const RenderElement* renderer, float multiplier) const
 {
+    ASSERT(renderer);
     if (m_fixedSize) {
-        FloatSize fixedSize = const_cast<CSSImageGeneratorValue&>(m_imageGeneratorValue.get()).fixedSize(renderer);
+        FloatSize fixedSize = const_cast<CSSImageGeneratorValue&>(m_imageGeneratorValue.get()).fixedSize(*renderer);
         if (multiplier == 1.0f)
             return fixedSize;
 
@@ -87,22 +88,26 @@
 
 void StyleGeneratedImage::addClient(RenderElement* renderer)
 {
-    m_imageGeneratorValue->addClient(renderer);
+    ASSERT(renderer);
+    m_imageGeneratorValue->addClient(*renderer);
 }
 
 void StyleGeneratedImage::removeClient(RenderElement* renderer)
 {
-    m_imageGeneratorValue->removeClient(renderer);
+    ASSERT(renderer);
+    m_imageGeneratorValue->removeClient(*renderer);
 }
 
 RefPtr<Image> StyleGeneratedImage::image(RenderElement* renderer, const FloatSize& size) const
 {
-    return const_cast<CSSImageGeneratorValue&>(m_imageGeneratorValue.get()).image(renderer, size);
+    ASSERT(renderer);
+    return const_cast<CSSImageGeneratorValue&>(m_imageGeneratorValue.get()).image(*renderer, size);
 }
 
 bool StyleGeneratedImage::knownToBeOpaque(const RenderElement* renderer) const
 {
-    return m_imageGeneratorValue->knownToBeOpaque(renderer);
+    ASSERT(renderer);
+    return m_imageGeneratorValue->knownToBeOpaque(*renderer);
 }
 
 }