Merge 106715

Source/WebCore/dom/ContainerNode.cpp

Index: Source/WebCore/dom/ContainerNode.cpp
===================================================================
--- Source/WebCore/dom/ContainerNode.cpp	(revision 107341)
+++ Source/WebCore/dom/ContainerNode.cpp	(working copy)
@@ -605,6 +605,8 @@
 
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
+    RefPtr<ContainerNode> protector(this);
+
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
     ASSERT(refCount() || parentOrHostNode());