Merge 107749

Source/WebCore/dom/ContainerNodeAlgorithms.h

 /*
  * Copyright (C) 2007 Apple Inc. All rights reserved.
  *           (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 117 matching lines @@
                 n->m_deletionHasBegun = true;
 #endif
                 // Add the node to the list of nodes to be deleted.
                 // Reuse the nextSibling pointer for this purpose.
                 if (tail)
                     tail->setNextSibling(n);
                 else
                     head = n;
 
                 tail = n;
-            } else
+            } else {
+                RefPtr<GenericNode> protect(n); // removedFromDocument may remove remove all references to this node.
                 NodeRemovalDispatcher<GenericNode, ShouldDispatchRemovalNotification<GenericNode>::value>::dispatch(n);
+            }
         }
 
         container->setFirstChild(0);
         container->setLastChild(0);
     }
 };
 
 } // namespace WebCore
 
 #endif // ContainerNodeAlgorithms_h