Protect an element while removing an attribute.

Source/core/dom/Element.cpp

Index: Source/core/dom/Element.cpp
diff --git a/Source/core/dom/Element.cpp b/Source/core/dom/Element.cpp
index b0b07eb1aeff28a2aa0bfc1f950aafa6d18b7bf6..89f8e9f9e4dc381b6fc62ea4c22703b3d43f1a16 100644
--- a/Source/core/dom/Element.cpp
+++ b/Source/core/dom/Element.cpp
@@ -2861,6 +2861,7 @@ void Element::didModifyAttribute(const QualifiedName& name, const AtomicString&
 
 void Element::didRemoveAttribute(const QualifiedName& name)
 {
+    RefPtr<Element> protect(this);

[sof, 2014/06/20 18:28:07]

Make it Oilpan friendly as "RefPtrWillBeRawPtr<Element> ..."

[esprehn, 2014/06/20 20:01:31]

Does the RefPtr need to be higher up, what about the caller of this function?
They're left with a free |this|. I guess we call didRemoveAttribute last in the
chain, but that's pretty brittle.

Normally we put these at the top of the call stacks, so inside
::removeAttribute.

[Nate Chapin, 2014/06/20 20:17:42]

I perhaps over-optimized that, will move them to the various callers.

     attributeChanged(name, nullAtom);
     InspectorInstrumentation::didRemoveDOMAttr(this, name.localName());
     dispatchSubtreeModifiedEvent();