Merge 106715

Source/WebCore/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 587 matching lines @@
         if (removedChild->inDocument())
             removedChild->removedFromDocument();
         // removeChild() calls removedFromTree(true) if the child was not in the
         // document. There is no explanation for this discrepancy between removeChild()
         // and its optimized version removeChildren().
     }
 }
 
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
+    RefPtr<ContainerNode> protector(this);
+
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
     ASSERT(refCount() || parentOrHostNode());
 
     ec = 0;
 
     // Make sure adding the new child is ok
     checkAddChild(newChild.get(), ec);
     if (ec)
         return false;
@@ skipping 546 matching lines @@
     if (!document()->hasListenerType(Document::BEFORELOAD_LISTENER))
         return true;
 
     RefPtr<ContainerNode> protector(this);
     RefPtr<BeforeLoadEvent> beforeLoadEvent = BeforeLoadEvent::create(sourceURL);
     dispatchEvent(beforeLoadEvent.get());
     return !beforeLoadEvent->defaultPrevented();
 }
 
 } // namespace WebCore