RefPtr Node since it can be blown away in load event.

Source/core/editing/ApplyStyleCommand.cpp

Index: Source/core/editing/ApplyStyleCommand.cpp
diff --git a/Source/core/editing/ApplyStyleCommand.cpp b/Source/core/editing/ApplyStyleCommand.cpp
index 03c0b16754b8470c1bfac2ab0a2eb53109c7a861..d8810b17c319c64841afc050686c1262947f9c8c 100644
--- a/Source/core/editing/ApplyStyleCommand.cpp
+++ b/Source/core/editing/ApplyStyleCommand.cpp
@@ -1098,16 +1098,17 @@ void ApplyStyleCommand::removeInlineStyle(EditingStyle* style, const Position &s
     Position s = start.isNull() || start.isOrphan() ? pushDownStart : start;
     Position e = end.isNull() || end.isOrphan() ? pushDownEnd : end;
 
-    Node* node = start.deprecatedNode();
+    RefPtr<Node> node = start.deprecatedNode();
     while (node) {
         RefPtr<Node> next;
-        if (editingIgnoresContent(node)) {
+        if (editingIgnoresContent(node.get())) {
             ASSERT(node == end.deprecatedNode() || !node->contains(end.deprecatedNode()));
-            next = NodeTraversal::nextSkippingChildren(node);
-        } else
-            next = NodeTraversal::next(node);
-        if (node->isHTMLElement() && nodeFullySelected(node, start, end)) {
-            RefPtr<HTMLElement> elem = toHTMLElement(node);
+            next = NodeTraversal::nextSkippingChildren(node.get());
+        } else {
+            next = NodeTraversal::next(node.get());
+        }
+        if (node->isHTMLElement() && nodeFullySelected(node.get(), start, end)) {
+            RefPtr<HTMLElement> elem = toHTMLElement(node.get());
             RefPtr<Node> prev = NodeTraversal::previousPostOrder(elem.get());
             RefPtr<Node> next = NodeTraversal::next(elem.get());
             RefPtr<EditingStyle> styleToPushDown;
@@ -1141,7 +1142,7 @@ void ApplyStyleCommand::removeInlineStyle(EditingStyle* style, const Position &s
         }
         if (node == end.deprecatedNode())
             break;
-        node = next.get();
+        node = next;
     }
 
     updateStartEnd(s, e);