[oilpan] Wrap NodeVector into CollectionRoot for ensure that contained nodes stay alive.

Source/core/editing/ApplyStyleCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1029 matching lines @@
     if (!highestAncestor)
         return;
 
     // The outer loop is traversing the tree vertically from highestAncestor to targetNode
     Handle<Node> current = highestAncestor;
     // Along the way, styled elements that contain targetNode are removed and accumulated into elementsToPushDown.
     // Each child of the removed element, exclusing ancestors of targetNode, is then wrapped by clones of elements in elementsToPushDown.
     CollectionRoot<Vector<Member<Element> > > elementsToPushDown;
     while (current && current != targetNode && current->contains(adoptRawResult(targetNode))) {
         HandleScope scope;
-        CollectionRoot<NodeVector> currentChildren;
-        getChildNodes(current.raw(), *currentChildren);
+        NodeVector currentChildren;
+        getChildNodes(current.raw(), currentChildren);
         Handle<StyledElement> styledElement;
         if (current->isStyledElement() && isStyledInlineElementToRemove(toElement(current))) {
             styledElement = Handle<StyledElement>::cast(current);
             elementsToPushDown->append(styledElement);
         }
 
         RefPtr<EditingStyle> styleToPushDown = EditingStyle::create();
         if (current->isHTMLElement())
             removeInlineStyleFromElement(style, toHTMLElement(current.raw()), RemoveIfNeeded, styleToPushDown.get());
 
@@ skipping 506 matching lines @@
         String textToMove = nextText->data();
         insertTextIntoNode(childText, childText->length(), textToMove);
         removeNode(next.raw());
         // don't move child node pointer. it may want to merge with more text nodes.
     }
 
     updateStartEnd(newStart, newEnd);
 }
 
 }