Ensure string data is kept alive as long as there are CSSVariableData tokens pointing to it

third_party/WebKit/Source/core/css/CSSVariableData.cpp

Index: third_party/WebKit/Source/core/css/CSSVariableData.cpp
diff --git a/third_party/WebKit/Source/core/css/CSSVariableData.cpp b/third_party/WebKit/Source/core/css/CSSVariableData.cpp
index 1ec695b6459298bfe50f7899c6b4d45346efd787..ab7b7163704c3248347d9ec764a3cbb130b9e442 100644
--- a/third_party/WebKit/Source/core/css/CSSVariableData.cpp
+++ b/third_party/WebKit/Source/core/css/CSSVariableData.cpp
@@ -22,21 +22,23 @@ StylePropertySet* CSSVariableData::PropertySet() {
 }
 
 template <typename CharacterType>
-void CSSVariableData::UpdateTokens(const CSSParserTokenRange& range) {
+static void UpdateTokens(const CSSParserTokenRange& range,
+                         const String& backing_string,
+                         Vector<CSSParserToken>& result) {
   const CharacterType* current_offset =
-      backing_string_.GetCharacters<CharacterType>();
+      backing_string.GetCharacters<CharacterType>();
   for (const CSSParserToken& token : range) {
     if (token.HasStringBacking()) {
       unsigned length = token.Value().length();
       StringView string(current_offset, length);
-      tokens_.push_back(token.CopyWithUpdatedString(string));
+      result.push_back(token.CopyWithUpdatedString(string));
       current_offset += length;
     } else {
-      tokens_.push_back(token);
+      result.push_back(token);
     }
   }
-  DCHECK(current_offset == backing_string_.GetCharacters<CharacterType>() +
-                               backing_string_.length());
+  DCHECK(current_offset == backing_string.GetCharacters<CharacterType>() +
+                               backing_string.length());
 }
 
 bool CSSVariableData::operator==(const CSSVariableData& other) const {
@@ -44,6 +46,8 @@ bool CSSVariableData::operator==(const CSSVariableData& other) const {
 }
 
 void CSSVariableData::ConsumeAndUpdateTokens(const CSSParserTokenRange& range) {
+  DCHECK_EQ(tokens_.size(), 0u);
+  DCHECK_EQ(backing_strings_.size(), 0u);
   StringBuilder string_builder;
   CSSParserTokenRange local_range = range;
 
@@ -52,11 +56,12 @@ void CSSVariableData::ConsumeAndUpdateTokens(const CSSParserTokenRange& range) {
     if (token.HasStringBacking())
       string_builder.Append(token.Value());
   }
-  backing_string_ = string_builder.ToString();
-  if (backing_string_.Is8Bit())
-    UpdateTokens<LChar>(range);
+  String backing_string = string_builder.ToString();
+  backing_strings_.push_back(backing_string);
+  if (backing_string.Is8Bit())
+    UpdateTokens<LChar>(range, backing_string, tokens_);
   else
-    UpdateTokens<UChar>(range);
+    UpdateTokens<UChar>(range, backing_string, tokens_);
 }
 
 CSSVariableData::CSSVariableData(const CSSParserTokenRange& range,