RefPtr Node since it can be blown away in load event.

Source/core/editing/ApplyStyleCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1080 matching lines @@
     pushDownInlineStyleAroundNode(style, pushDownEnd.deprecatedNode());
 
     // The s and e variables store the positions used to set the ending selection after style removal
     // takes place. This will help callers to recognize when either the start node or the end node
     // are removed from the document during the work of this function.
     // If pushDownInlineStyleAroundNode has pruned start.deprecatedNode() or end.deprecatedNode(),
     // use pushDownStart or pushDownEnd instead, which pushDownInlineStyleAroundNode won't prune.
     Position s = start.isNull() || start.isOrphan() ? pushDownStart : start;
     Position e = end.isNull() || end.isOrphan() ? pushDownEnd : end;
 
-    Node* node = start.deprecatedNode();
+    RefPtr<Node> node = start.deprecatedNode();
     while (node) {
         RefPtr<Node> next;
-        if (editingIgnoresContent(node)) {
+        if (editingIgnoresContent(node.get())) {
             ASSERT(node == end.deprecatedNode() || !node->contains(end.deprecatedNode()));
-            next = NodeTraversal::nextSkippingChildren(node);
-        } else
-            next = NodeTraversal::next(node);
-        if (node->isHTMLElement() && nodeFullySelected(node, start, end)) {
-            RefPtr<HTMLElement> elem = toHTMLElement(node);
+            next = NodeTraversal::nextSkippingChildren(node.get());
+        } else {
+            next = NodeTraversal::next(node.get());
+        }
+        if (node->isHTMLElement() && nodeFullySelected(node.get(), start, end)) {
+            RefPtr<HTMLElement> elem = toHTMLElement(node.get());
             RefPtr<Node> prev = NodeTraversal::previousPostOrder(elem.get());
             RefPtr<Node> next = NodeTraversal::next(elem.get());
             RefPtr<EditingStyle> styleToPushDown;
             RefPtr<Node> childNode;
             if (isStyledInlineElementToRemove(elem.get())) {
                 styleToPushDown = EditingStyle::create();
                 childNode = elem->firstChild();
             }
 
             removeInlineStyleFromElement(style, elem.get(), RemoveIfNeeded, styleToPushDown.get());
@@ skipping 13 matching lines @@
                 }
             }
 
             if (styleToPushDown) {
                 for (; childNode; childNode = childNode->nextSibling())
                     applyInlineStyleToPushDown(childNode.get(), styleToPushDown.get());
             }
         }
         if (node == end.deprecatedNode())
             break;
-        node = next.get();
+        node = next;
     }
 
     updateStartEnd(s, e);
 }
 
 bool ApplyStyleCommand::nodeFullySelected(Node *node, const Position &start, const Position &end) const
 {
     ASSERT(node);
     ASSERT(node->isElementNode());
 
@@ skipping 385 matching lines @@
         String textToMove = nextText->data();
         insertTextIntoNode(childText, childText->length(), textToMove);
         removeNode(next);
         // don't move child node pointer. it may want to merge with more text nodes.
     }
 
     updateStartEnd(newStart, newEnd);
 }
 
 }