Merge 98796 - Potential crash in ReplaceNodeWithSpanCommand

Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp

 /*
  * Copyright (c) 2009 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  * 
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 34 matching lines @@
     : SimpleEditCommand(element->document())
     , m_elementToReplace(element)
 {
     ASSERT(m_elementToReplace);
 }
 
 static void swapInNodePreservingAttributesAndChildren(HTMLElement* newNode, HTMLElement* nodeToReplace)
 {
     ASSERT(nodeToReplace->inDocument());
     ExceptionCode ec = 0;
-    ContainerNode* parentNode = nodeToReplace->parentNode();
+    RefPtr<ContainerNode> parentNode = nodeToReplace->parentNode();
     parentNode->insertBefore(newNode, nodeToReplace, ec);
     ASSERT(!ec);
 
     RefPtr<Node> nextChild;
     for (Node* child = nodeToReplace->firstChild(); child; child = nextChild.get()) {
         nextChild = child->nextSibling();
         newNode->appendChild(child, ec);
         ASSERT(!ec);
     }
 
@@ skipping 13 matching lines @@
 }
 
 void ReplaceNodeWithSpanCommand::doUnapply()
 {
     if (!m_spanElement->inDocument())
         return;
     swapInNodePreservingAttributesAndChildren(m_elementToReplace.get(), m_spanElement.get());
 }
 
 } // namespace WebCore