[oilpan] Wrap NodeVector into CollectionRoot for ensure that contained nodes stay alive.

Source/core/editing/ReplaceNodeWithSpanCommand.cpp

 /*
  * Copyright (c) 2009 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  * 
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 38 matching lines @@
 }
 
 static void swapInNodePreservingAttributesAndChildren(const Handle<HTMLElement>& newNode, const Handle<HTMLElement>& nodeToReplace)
 {
     ASSERT(nodeToReplace->inDocument());
     Handle<ContainerNode> parentNode = nodeToReplace->parentNode();
     parentNode->insertBefore(newNode, nodeToReplace, ASSERT_NO_EXCEPTION);
 
     NodeVector children;
     getChildNodes(nodeToReplace.raw(), children);
-    for (size_t i = 0; i < children.size(); ++i)
+    for (size_t i = 0; i < children->size(); ++i)
         newNode->appendChild(children[i], ASSERT_NO_EXCEPTION);
 
     // FIXME: Fix this to send the proper MutationRecords when MutationObservers are present.
     newNode->cloneDataFromElement(*nodeToReplace.raw());
 
     parentNode->removeChild(nodeToReplace, ASSERT_NO_EXCEPTION);
 }
 
 void ReplaceNodeWithSpanCommand::doApply()
 {
@@ skipping 13 matching lines @@
 
 #ifndef NDEBUG
 void ReplaceNodeWithSpanCommand::getNodesInCommand(HashSet<Node*>& nodes)
 {
     addNodeAndDescendants(m_elementToReplace.raw(), nodes);
     addNodeAndDescendants(m_spanElement.raw(), nodes);
 }
 #endif
 
 } // namespace WebCore