Merge 106972

Source/WebCore/dom/ContainerNode.cpp

Index: Source/WebCore/dom/ContainerNode.cpp
===================================================================
--- Source/WebCore/dom/ContainerNode.cpp	(revision 107340)
+++ Source/WebCore/dom/ContainerNode.cpp	(working copy)
@@ -116,6 +116,8 @@
     // If it is, it can be deleted as a side effect of sending mutation events.
     ASSERT(refCount() || parentOrHostNode());
 
+    RefPtr<Node> protect(this);
+
     ec = 0;
 
     // insertBefore(node, 0) is equivalent to appendChild(node)
@@ -261,6 +263,8 @@
     // If it is, it can be deleted as a side effect of sending mutation events.
     ASSERT(refCount() || parentOrHostNode());
 
+    RefPtr<Node> protect(this);
+
     ec = 0;
 
     if (oldChild == newChild) // nothing to do
@@ -427,6 +431,8 @@
     // If it is, it can be deleted as a side effect of sending mutation events.
     ASSERT(refCount() || parentOrHostNode());
 
+    RefPtr<Node> protect(this);
+
     ec = 0;
 
     // NO_MODIFICATION_ALLOWED_ERR: Raised if this node is readonly.
@@ -605,7 +611,7 @@
 
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
-    RefPtr<ContainerNode> protector(this);
+    RefPtr<ContainerNode> protect(this);
 
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.