Merge 92966

Source/WebCore/editing/ReplaceSelectionCommand.cpp

Index: Source/WebCore/editing/ReplaceSelectionCommand.cpp
===================================================================
--- Source/WebCore/editing/ReplaceSelectionCommand.cpp	(revision 92967)
+++ Source/WebCore/editing/ReplaceSelectionCommand.cpp	(working copy)
@@ -139,7 +139,7 @@
     if (!m_fragment->firstChild())
         return;
     
-    Element* editableRoot = selection.rootEditableElement();
+    RefPtr<Element> editableRoot = selection.rootEditableElement();
     ASSERT(editableRoot);
     if (!editableRoot)
         return;
@@ -154,8 +154,8 @@
         return;
     }
 
-    Node* styleNode = selection.base().deprecatedNode();
-    RefPtr<StyledElement> holder = insertFragmentForTestRendering(styleNode);
+    RefPtr<Node> styleNode = selection.base().deprecatedNode();
+    RefPtr<StyledElement> holder = insertFragmentForTestRendering(styleNode.get());
     if (!holder) {
         removeInterchangeNodes(m_fragment.get());
         return;
@@ -175,7 +175,7 @@
         m_fragment = createFragmentFromText(selection.toNormalizedRange().get(), evt->text());
         if (!m_fragment->firstChild())
             return;
-        holder = insertFragmentForTestRendering(styleNode);
+        holder = insertFragmentForTestRendering(styleNode.get());
     }
     
     removeInterchangeNodes(holder.get());