We are indeed creating the LayerTreeHost always from a WebPage reference but getting its address to pass it to the LayerTreeHost create() function.
Created attachment 280794 [details] Patch
Committed r201802: <http://trac.webkit.org/changeset/201802>