Hold a reference to the ancestor node used for hover-state adjustments.

If a 'hover' or 'mouseenter' event blows away the whole document, bad things
happen. This patch adjusts Document::updateHoverActiveState to hold a RefPtr
to the one Node that wasn't ref'd in the hopes of making address sanitizer
a little bit less sad.

R=jochen@chromium.org
BUG=300892

Review URL: https://codereview.chromium.org/78363002

git-svn-id: svn://svn.chromium.org/blink/trunk@162370 bbb929c8-8fbe-4397-9dbb-9b2b20218538