<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[189576] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/189576">189576</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2015-09-10 11:02:15 -0700 (Thu, 10 Sep 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>Node.appendChild(null) / replaceChild(null, null) / removeChild(null) / insertBefore(null, ref) should throw a TypeError
https://bugs.webkit.org/show_bug.cgi?id=148971
&lt;rdar://problem/22560883&gt;
&lt;rdar://problem/22559225&gt;

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C tests now that more checks are passing.

* web-platform-tests/dom/interfaces-expected.txt:
* web-platform-tests/dom/nodes/Node-appendChild-expected.txt:
* web-platform-tests/dom/nodes/Node-insertBefore-expected.txt:
* web-platform-tests/dom/nodes/Node-removeChild-expected.txt:
* web-platform-tests/dom/nodes/Node-replaceChild-expected.txt:
* web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Node.appendChild(null) / replaceChild(null, null) / removeChild(null)
and insertBefore(null, ref) should throw a TypeError instead of a
NotFoundError, as per the specification:
https://dom.spec.whatwg.org/#node

The parameters are not nullable so the Web IDL specification says
we should throw a TypeError in this case.

This patch moves the null-checking from ContainerNode to the methods
on Node. The null-checking is supposed to be done by the bindings code
but our generator currently does not support this so we do the null
checking as close to the bindings as possible. The bindings code is
calling the methods on Node. This also makes sure we throw a TypeError
for null-argument when the Node is not a ContainerNode. For e.g.
Text.appendChild(null) should throw a TypeError too.

The methods on ContainerNode now take references insteaad of pointer
parameters now that the null-checking is done at the call site in
Node. This lead to a lot of code update as those methods are used
a lot throughout the code base.

No new tests, already covered by pre-existing layout tests.

Source/WebKit/mac:

ContainerNode::appendChild() now takes a Ref&lt;Node&gt;&amp;&amp; parameter so we
need to update the call site.

* WebView/WebFrame.mm:
(-[WebFrame _documentFragmentWithNodesAsParagraphs:]):

Source/WebKit2:

ContainerNode::appendChild() now takes a Ref&lt;Node&gt;&amp;&amp; parameter so we
need to update the call sites.

* WebProcess/Plugins/PDF/PDFPlugin.mm:
(WebKit::PDFPlugin::PDFPlugin):
* WebProcess/Plugins/PDF/PDFPluginAnnotation.mm:
(WebKit::PDFPluginAnnotation::attach):
(WebKit::PDFPluginAnnotation::~PDFPluginAnnotation):
* WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm:
(WebKit::PDFPluginChoiceAnnotation::createAnnotationElement):

LayoutTests:

Update / rebaseline tests now that we throw a different exception type.

* fast/dom/Document/replaceChild-null-oldChild-expected.txt:
* fast/dom/Document/script-tests/replaceChild-null-oldChild.js:
* fast/dom/Node/fragment-mutation-expected.txt:
* fast/dom/Node/fragment-mutation.html:
* fast/dom/incompatible-operations-expected.txt:
* fast/dom/incompatible-operations.html:
* fast/dom/move-nodes-across-documents.html:
* fast/dom/processing-instruction-appendChild-exceptions-expected.txt:
* fast/dom/processing-instruction-appendChild-exceptions.xhtml:
* fast/dom/setter-type-enforcement-expected.txt:
* fast/dom/timer-clear-interval-in-handler-and-generate-error-expected.txt:
* fast/inspector-support/uncaught-dom8-exception.html:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsfastdomDocumentreplaceChildnulloldChildexpectedtxt">trunk/LayoutTests/fast/dom/Document/replaceChild-null-oldChild-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdomDocumentscripttestsreplaceChildnulloldChildjs">trunk/LayoutTests/fast/dom/Document/script-tests/replaceChild-null-oldChild.js</a></li>
<li><a href="#trunkLayoutTestsfastdomNodefragmentmutationexpectedtxt">trunk/LayoutTests/fast/dom/Node/fragment-mutation-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdomNodefragmentmutationhtml">trunk/LayoutTests/fast/dom/Node/fragment-mutation.html</a></li>
<li><a href="#trunkLayoutTestsfastdomincompatibleoperationsexpectedtxt">trunk/LayoutTests/fast/dom/incompatible-operations-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdomincompatibleoperationshtml">trunk/LayoutTests/fast/dom/incompatible-operations.html</a></li>
<li><a href="#trunkLayoutTestsfastdommovenodesacrossdocumentshtml">trunk/LayoutTests/fast/dom/move-nodes-across-documents.html</a></li>
<li><a href="#trunkLayoutTestsfastdomprocessinginstructionappendChildexceptionsexpectedtxt">trunk/LayoutTests/fast/dom/processing-instruction-appendChild-exceptions-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdomprocessinginstructionappendChildexceptionsxhtml">trunk/LayoutTests/fast/dom/processing-instruction-appendChild-exceptions.xhtml</a></li>
<li><a href="#trunkLayoutTestsfastdomtimerclearintervalinhandlerandgenerateerrorexpectedtxt">trunk/LayoutTests/fast/dom/timer-clear-interval-in-handler-and-generate-error-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfasteventsremovetargetwithshadowindragexpectedtxt">trunk/LayoutTests/fast/events/remove-target-with-shadow-in-drag-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastinspectorsupportuncaughtdom8exceptionhtml">trunk/LayoutTests/fast/inspector-support/uncaught-dom8-exception.html</a></li>
<li><a href="#trunkLayoutTestsimportedw3cChangeLog">trunk/LayoutTests/imported/w3c/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsdominterfacesexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/dom/interfaces-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsdomnodesNodeappendChildexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-appendChild-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsdomnodesNodeinsertBeforeexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-insertBefore-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsdomnodesNoderemoveChildexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-removeChild-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsdomnodesNodereplaceChildexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-replaceChild-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomdotnodebaseexceptionexpectedtxt">trunk/LayoutTests/js/dom/dot-node-base-exception-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomscripttestsdotnodebaseexceptionjs">trunk/LayoutTests/js/dom/script-tests/dot-node-base-exception.js</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreModulespluginsYouTubePluginReplacementcpp">trunk/Source/WebCore/Modules/plugins/YouTubePluginReplacement.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsobjcDOMHTMLmm">trunk/Source/WebCore/bindings/objc/DOMHTML.mm</a></li>
<li><a href="#trunkSourceWebCoredomAttrcpp">trunk/Source/WebCore/dom/Attr.cpp</a></li>
<li><a href="#trunkSourceWebCoredomAttrh">trunk/Source/WebCore/dom/Attr.h</a></li>
<li><a href="#trunkSourceWebCoredomCDATASectioncpp">trunk/Source/WebCore/dom/CDATASection.cpp</a></li>
<li><a href="#trunkSourceWebCoredomCDATASectionh">trunk/Source/WebCore/dom/CDATASection.h</a></li>
<li><a href="#trunkSourceWebCoredomCommentcpp">trunk/Source/WebCore/dom/Comment.cpp</a></li>
<li><a href="#trunkSourceWebCoredomCommenth">trunk/Source/WebCore/dom/Comment.h</a></li>
<li><a href="#trunkSourceWebCoredomContainerNodecpp">trunk/Source/WebCore/dom/ContainerNode.cpp</a></li>
<li><a href="#trunkSourceWebCoredomContainerNodeh">trunk/Source/WebCore/dom/ContainerNode.h</a></li>
<li><a href="#trunkSourceWebCoredomDOMImplementationcpp">trunk/Source/WebCore/dom/DOMImplementation.cpp</a></li>
<li><a href="#trunkSourceWebCoredomDocumentcpp">trunk/Source/WebCore/dom/Document.cpp</a></li>
<li><a href="#trunkSourceWebCoredomDocumenth">trunk/Source/WebCore/dom/Document.h</a></li>
<li><a href="#trunkSourceWebCoredomDocumentFragmentcpp">trunk/Source/WebCore/dom/DocumentFragment.cpp</a></li>
<li><a href="#trunkSourceWebCoredomDocumentFragmenth">trunk/Source/WebCore/dom/DocumentFragment.h</a></li>
<li><a href="#trunkSourceWebCoredomDocumentTypecpp">trunk/Source/WebCore/dom/DocumentType.cpp</a></li>
<li><a href="#trunkSourceWebCoredomDocumentTypeh">trunk/Source/WebCore/dom/DocumentType.h</a></li>
<li><a href="#trunkSourceWebCoredomElementcpp">trunk/Source/WebCore/dom/Element.cpp</a></li>
<li><a href="#trunkSourceWebCoredomElementh">trunk/Source/WebCore/dom/Element.h</a></li>
<li><a href="#trunkSourceWebCoredomEntityReferencecpp">trunk/Source/WebCore/dom/EntityReference.cpp</a></li>
<li><a href="#trunkSourceWebCoredomEntityReferenceh">trunk/Source/WebCore/dom/EntityReference.h</a></li>
<li><a href="#trunkSourceWebCoredomNodecpp">trunk/Source/WebCore/dom/Node.cpp</a></li>
<li><a href="#trunkSourceWebCoredomNodeh">trunk/Source/WebCore/dom/Node.h</a></li>
<li><a href="#trunkSourceWebCoredomProcessingInstructioncpp">trunk/Source/WebCore/dom/ProcessingInstruction.cpp</a></li>
<li><a href="#trunkSourceWebCoredomProcessingInstructionh">trunk/Source/WebCore/dom/ProcessingInstruction.h</a></li>
<li><a href="#trunkSourceWebCoredomRangecpp">trunk/Source/WebCore/dom/Range.cpp</a></li>
<li><a href="#trunkSourceWebCoredomShadowRootcpp">trunk/Source/WebCore/dom/ShadowRoot.cpp</a></li>
<li><a href="#trunkSourceWebCoredomShadowRooth">trunk/Source/WebCore/dom/ShadowRoot.h</a></li>
<li><a href="#trunkSourceWebCoredomTextcpp">trunk/Source/WebCore/dom/Text.cpp</a></li>
<li><a href="#trunkSourceWebCoredomTexth">trunk/Source/WebCore/dom/Text.h</a></li>
<li><a href="#trunkSourceWebCoreeditingAppendNodeCommandcpp">trunk/Source/WebCore/editing/AppendNodeCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingAppendNodeCommandh">trunk/Source/WebCore/editing/AppendNodeCommand.h</a></li>
<li><a href="#trunkSourceWebCoreeditingCompositeEditCommandcpp">trunk/Source/WebCore/editing/CompositeEditCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingDeleteSelectionCommandcpp">trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingEditorcpp">trunk/Source/WebCore/editing/Editor.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingEditorCommandcpp">trunk/Source/WebCore/editing/EditorCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingInsertLineBreakCommandcpp">trunk/Source/WebCore/editing/InsertLineBreakCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingInsertNodeBeforeCommandcpp">trunk/Source/WebCore/editing/InsertNodeBeforeCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingInsertParagraphSeparatorCommandcpp">trunk/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingMergeIdenticalElementsCommandcpp">trunk/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingRemoveNodeCommandcpp">trunk/Source/WebCore/editing/RemoveNodeCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingRemoveNodeCommandh">trunk/Source/WebCore/editing/RemoveNodeCommand.h</a></li>
<li><a href="#trunkSourceWebCoreeditingReplaceNodeWithSpanCommandcpp">trunk/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingReplaceSelectionCommandcpp">trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingSplitElementCommandcpp">trunk/Source/WebCore/editing/SplitElementCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingSplitTextNodeCommandcpp">trunk/Source/WebCore/editing/SplitTextNodeCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingWrapContentsInDummySpanCommandcpp">trunk/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingcocoaEditorCocoamm">trunk/Source/WebCore/editing/cocoa/EditorCocoa.mm</a></li>
<li><a href="#trunkSourceWebCoreeditinghtmleditingcpp">trunk/Source/WebCore/editing/htmlediting.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditinghtmleditingh">trunk/Source/WebCore/editing/htmlediting.h</a></li>
<li><a href="#trunkSourceWebCoreeditingiosEditorIOSmm">trunk/Source/WebCore/editing/ios/EditorIOS.mm</a></li>
<li><a href="#trunkSourceWebCoreeditingmacEditorMacmm">trunk/Source/WebCore/editing/mac/EditorMac.mm</a></li>
<li><a href="#trunkSourceWebCoreeditingmarkupcpp">trunk/Source/WebCore/editing/markup.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingmarkuph">trunk/Source/WebCore/editing/markup.h</a></li>
<li><a href="#trunkSourceWebCorehtmlBaseChooserOnlyDateAndTimeInputTypecpp">trunk/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlColorInputTypecpp">trunk/Source/WebCore/html/ColorInputType.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlFTPDirectoryDocumentcpp">trunk/Source/WebCore/html/FTPDirectoryDocument.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLDetailsElementcpp">trunk/Source/WebCore/html/HTMLDetailsElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLElementcpp">trunk/Source/WebCore/html/HTMLElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLElementh">trunk/Source/WebCore/html/HTMLElement.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLImageElementcpp">trunk/Source/WebCore/html/HTMLImageElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLKeygenElementcpp">trunk/Source/WebCore/html/HTMLKeygenElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMeterElementcpp">trunk/Source/WebCore/html/HTMLMeterElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLOptionElementcpp">trunk/Source/WebCore/html/HTMLOptionElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLProgressElementcpp">trunk/Source/WebCore/html/HTMLProgressElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLScriptElementcpp">trunk/Source/WebCore/html/HTMLScriptElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLScriptElementh">trunk/Source/WebCore/html/HTMLScriptElement.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLSelectElementcpp">trunk/Source/WebCore/html/HTMLSelectElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTableElementcpp">trunk/Source/WebCore/html/HTMLTableElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTableElementh">trunk/Source/WebCore/html/HTMLTableElement.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTableRowElementcpp">trunk/Source/WebCore/html/HTMLTableRowElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTableRowElementh">trunk/Source/WebCore/html/HTMLTableRowElement.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTableSectionElementcpp">trunk/Source/WebCore/html/HTMLTableSectionElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTemplateElementcpp">trunk/Source/WebCore/html/HTMLTemplateElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTemplateElementh">trunk/Source/WebCore/html/HTMLTemplateElement.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTextAreaElementcpp">trunk/Source/WebCore/html/HTMLTextAreaElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlImageDocumentcpp">trunk/Source/WebCore/html/ImageDocument.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlMediaDocumentcpp">trunk/Source/WebCore/html/MediaDocument.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlPluginDocumentcpp">trunk/Source/WebCore/html/PluginDocument.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlRangeInputTypecpp">trunk/Source/WebCore/html/RangeInputType.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlSearchInputTypecpp">trunk/Source/WebCore/html/SearchInputType.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlTextFieldInputTypecpp">trunk/Source/WebCore/html/TextFieldInputType.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlValidationMessagecpp">trunk/Source/WebCore/html/ValidationMessage.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlshadowMediaControlElementscpp">trunk/Source/WebCore/html/shadow/MediaControlElements.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlshadowMediaControlscpp">trunk/Source/WebCore/html/shadow/MediaControls.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlshadowMediaControlsApplecpp">trunk/Source/WebCore/html/shadow/MediaControlsApple.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlshadowSliderThumbElementcpp">trunk/Source/WebCore/html/shadow/SliderThumbElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlshadowSliderThumbElementh">trunk/Source/WebCore/html/shadow/SliderThumbElement.h</a></li>
<li><a href="#trunkSourceWebCorehtmlshadowmacImageControlsRootElementMaccpp">trunk/Source/WebCore/html/shadow/mac/ImageControlsRootElementMac.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmltrackVTTCuecpp">trunk/Source/WebCore/html/track/VTTCue.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmltrackVTTRegioncpp">trunk/Source/WebCore/html/track/VTTRegion.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmltrackVTTRegionh">trunk/Source/WebCore/html/track/VTTRegion.h</a></li>
<li><a href="#trunkSourceWebCorehtmltrackWebVTTElementcpp">trunk/Source/WebCore/html/track/WebVTTElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmltrackWebVTTElementh">trunk/Source/WebCore/html/track/WebVTTElement.h</a></li>
<li><a href="#trunkSourceWebCoreinspectorInspectorCSSAgentcpp">trunk/Source/WebCore/inspector/InspectorCSSAgent.cpp</a></li>
<li><a href="#trunkSourceWebCorepageDragControllercpp">trunk/Source/WebCore/page/DragController.cpp</a></li>
<li><a href="#trunkSourceWebCorepageiosFrameIOSmm">trunk/Source/WebCore/page/ios/FrameIOS.mm</a></li>
<li><a href="#trunkSourceWebCoresvgSVGScriptElementcpp">trunk/Source/WebCore/svg/SVGScriptElement.cpp</a></li>
<li><a href="#trunkSourceWebCoresvgSVGScriptElementh">trunk/Source/WebCore/svg/SVGScriptElement.h</a></li>
<li><a href="#trunkSourceWebCoresvgSVGUseElementcpp">trunk/Source/WebCore/svg/SVGUseElement.cpp</a></li>
<li><a href="#trunkSourceWebCorexmlXMLTreeViewercpp">trunk/Source/WebCore/xml/XMLTreeViewer.cpp</a></li>
<li><a href="#trunkSourceWebKitmacChangeLog">trunk/Source/WebKit/mac/ChangeLog</a></li>
<li><a href="#trunkSourceWebKitmacWebViewWebFramemm">trunk/Source/WebKit/mac/WebView/WebFrame.mm</a></li>
<li><a href="#trunkSourceWebKitmacWebViewWebHTMLViewmm">trunk/Source/WebKit/mac/WebView/WebHTMLView.mm</a></li>
<li><a href="#trunkSourceWebKit2ChangeLog">trunk/Source/WebKit2/ChangeLog</a></li>
<li><a href="#trunkSourceWebKit2WebProcessPluginsPDFPDFPluginmm">trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm</a></li>
<li><a href="#trunkSourceWebKit2WebProcessPluginsPDFPDFPluginAnnotationmm">trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm</a></li>
<li><a href="#trunkSourceWebKit2WebProcessPluginsPDFPDFPluginChoiceAnnotationmm">trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/ChangeLog        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,3 +1,27 @@
</span><ins>+2015-09-10  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Node.appendChild(null) / replaceChild(null, null) / removeChild(null) / insertBefore(null, ref) should throw a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=148971
+        &lt;rdar://problem/22560883&gt;
+        &lt;rdar://problem/22559225&gt;
+
+        Reviewed by Ryosuke Niwa.
+
+        Update / rebaseline tests now that we throw a different exception type.
+
+        * fast/dom/Document/replaceChild-null-oldChild-expected.txt:
+        * fast/dom/Document/script-tests/replaceChild-null-oldChild.js:
+        * fast/dom/Node/fragment-mutation-expected.txt:
+        * fast/dom/Node/fragment-mutation.html:
+        * fast/dom/incompatible-operations-expected.txt:
+        * fast/dom/incompatible-operations.html:
+        * fast/dom/move-nodes-across-documents.html:
+        * fast/dom/processing-instruction-appendChild-exceptions-expected.txt:
+        * fast/dom/processing-instruction-appendChild-exceptions.xhtml:
+        * fast/dom/setter-type-enforcement-expected.txt:
+        * fast/dom/timer-clear-interval-in-handler-and-generate-error-expected.txt:
+        * fast/inspector-support/uncaught-dom8-exception.html:
+
</ins><span class="cx"> 2015-09-10  Brady Eidson  &lt;beidson@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Mark some more W3C IDB tests as flaky.
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomDocumentreplaceChildnulloldChildexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Document/replaceChild-null-oldChild-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Document/replaceChild-null-oldChild-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/Document/replaceChild-null-oldChild-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -3,7 +3,7 @@
</span><span class="cx"> On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-PASS document.replaceChild(document.firstChild, null) threw exception Error: NotFoundError: DOM Exception 8.
</del><ins>+PASS document.replaceChild(document.firstChild, null) threw exception TypeError: Type error.
</ins><span class="cx"> PASS successfullyParsed is true
</span><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomDocumentscripttestsreplaceChildnulloldChildjs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Document/script-tests/replaceChild-null-oldChild.js (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Document/script-tests/replaceChild-null-oldChild.js        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/Document/script-tests/replaceChild-null-oldChild.js        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,3 +1,3 @@
</span><span class="cx"> description('Test behavior of Document.replaceChild() when oldChild is null.');
</span><span class="cx"> 
</span><del>-shouldThrow('document.replaceChild(document.firstChild, null)', '&quot;Error: NotFoundError: DOM Exception 8&quot;');
</del><ins>+shouldThrow('document.replaceChild(document.firstChild, null)', '&quot;TypeError: Type error&quot;');
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdomNodefragmentmutationexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Node/fragment-mutation-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Node/fragment-mutation-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/Node/fragment-mutation-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -2,12 +2,12 @@
</span><span class="cx"> 
</span><span class="cx"> Inserting an element in front of the next item in fragment should not affect the result: PASS
</span><span class="cx"> Appending an element at the end of the fragment should not affect the result: PASS
</span><del>-Continually re-appending removed element to the fragment should eventually throw NOT_FOUND_ERR: PASS
</del><ins>+Continually re-appending removed element to the fragment should eventually throw a TypeError: PASS
</ins><span class="cx"> 
</span><span class="cx"> This test creates a fragment containing three elements: &quot;B&quot;, &quot;U&quot;, and &quot;P&quot;, attempts to insertBefore this fragment and studies effects of mutation events on the fragment.
</span><span class="cx"> 
</span><span class="cx"> Inserting an element in front of the next item in fragment should not affect the result: PASS
</span><span class="cx"> Appending an element at the end of the fragment should not affect the result: PASS
</span><del>-Continually re-appending removed element to the fragment should eventually throw NOT_FOUND_ERR: PASS
</del><ins>+Continually re-appending removed element to the fragment should eventually throw a TypeError: PASS
</ins><span class="cx"> 
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomNodefragmentmutationhtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Node/fragment-mutation.html (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Node/fragment-mutation.html        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/Node/fragment-mutation.html        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -36,15 +36,15 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-function expectException(code)
</del><ins>+function expectTypeError()
</ins><span class="cx"> {
</span><span class="cx">     return function(stash, exception) {
</span><span class="cx">         if (!exception)
</span><del>-            return &quot;FAIL, expected exception with code &quot; + code + &quot;. The resulting fragment was: \&quot;&quot; + produceNodeNameString(stash) + &quot;\&quot;.&quot;;
</del><ins>+            return &quot;FAIL, expected TypeError. The resulting fragment was: \&quot;&quot; + produceNodeNameString(stash) + &quot;\&quot;.&quot;;
</ins><span class="cx"> 
</span><del>-        if (code == exception.code)
</del><ins>+        if (exception.name = &quot;TypeError&quot;)
</ins><span class="cx">             return &quot;PASS&quot;;
</span><del>-        return &quot;FAIL, expected exception code: &quot; + code + &quot;, was: &quot; + exception + &quot;.&quot;;
</del><ins>+        return &quot;FAIL, expected TypeError, was: &quot; + exception.name + &quot;.&quot;;
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -119,10 +119,10 @@
</span><span class="cx">         frag.appendChild(extra);
</span><span class="cx">     }, expectNodes(&quot;BUP&quot;));
</span><span class="cx"> 
</span><del>-    testFragment(method, &quot;Continually re-appending removed element to the fragment should eventually throw NOT_FOUND_ERR&quot;, function(evt, frag, stash)
</del><ins>+    testFragment(method, &quot;Continually re-appending removed element to the fragment should eventually throw a TypeError&quot;, function(evt, frag, stash)
</ins><span class="cx">     {
</span><span class="cx">         stash.insertBefore(frag.lastChild, stash.firstChild);
</span><del>-    }, expectException(8), true);
</del><ins>+    }, expectTypeError(), true);
</ins><span class="cx">     printLog(methodName);
</span><span class="cx"> }
</span><span class="cx"> function runTests()
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomincompatibleoperationsexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/incompatible-operations-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/incompatible-operations-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/incompatible-operations-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -3,9 +3,9 @@
</span><span class="cx"> On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-PASS aNode.appendChild(aDOMImplementation) threw exception Error: NotFoundError: DOM Exception 8.
-PASS aNode.appendChild('knort') threw exception Error: NotFoundError: DOM Exception 8.
-PASS aNode.appendChild(void 0) threw exception Error: NotFoundError: DOM Exception 8.
</del><ins>+PASS aNode.appendChild(aDOMImplementation) threw exception TypeError: Type error.
+PASS aNode.appendChild('knort') threw exception TypeError: Type error.
+PASS aNode.appendChild(void 0) threw exception TypeError: Type error.
</ins><span class="cx"> PASS aNode.isSameNode(aDOMImplementation) is false
</span><span class="cx"> PASS aNode.isSameNode('foo') is false
</span><span class="cx"> PASS aNode.isSameNode(void 0) is false
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomincompatibleoperationshtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/incompatible-operations.html (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/incompatible-operations.html        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/incompatible-operations.html        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -28,11 +28,11 @@
</span><span class="cx"> var aSecondNode = document.createElement(&quot;div&quot;);
</span><span class="cx"> aNode.appendChild(aSecondNode);
</span><span class="cx"> 
</span><del>-shouldThrow(&quot;aNode.appendChild(aDOMImplementation)&quot;, &quot;'Error: NotFoundError: DOM Exception 8'&quot;);
</del><ins>+shouldThrow(&quot;aNode.appendChild(aDOMImplementation)&quot;, &quot;'TypeError: Type error'&quot;);
</ins><span class="cx"> 
</span><del>-shouldThrow(&quot;aNode.appendChild('knort')&quot;, &quot;'Error: NotFoundError: DOM Exception 8'&quot;);
</del><ins>+shouldThrow(&quot;aNode.appendChild('knort')&quot;, &quot;'TypeError: Type error'&quot;);
</ins><span class="cx"> 
</span><del>-shouldThrow(&quot;aNode.appendChild(void 0)&quot;, &quot;'Error: NotFoundError: DOM Exception 8'&quot;);
</del><ins>+shouldThrow(&quot;aNode.appendChild(void 0)&quot;, &quot;'TypeError: Type error'&quot;);
</ins><span class="cx"> 
</span><span class="cx"> shouldBeFalse(&quot;aNode.isSameNode(aDOMImplementation)&quot;);
</span><span class="cx"> shouldBeFalse(&quot;aNode.isSameNode('foo')&quot;);
</span></span></pre></div>
<a id="trunkLayoutTestsfastdommovenodesacrossdocumentshtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/move-nodes-across-documents.html (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/move-nodes-across-documents.html        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/move-nodes-across-documents.html        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -179,7 +179,7 @@
</span><span class="cx">     runTest(function() {
</span><span class="cx">         iframeDoc.appendChild(document.doctype);
</span><span class="cx">         console.log(document.doctype);
</span><del>-    }, 'NotFoundError');
</del><ins>+    }, 'TypeError');
</ins><span class="cx"> 
</span><span class="cx">     // When setting a boundary of the range in a different
</span><span class="cx">     // document, the call should succeed and the range should be collapsed.
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomprocessinginstructionappendChildexceptionsexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/processing-instruction-appendChild-exceptions-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/processing-instruction-appendChild-exceptions-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/processing-instruction-appendChild-exceptions-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -3,7 +3,7 @@
</span><span class="cx"> On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-PASS pi.appendChild(null) threw exception Error: HierarchyRequestError: DOM Exception 3.
</del><ins>+PASS pi.appendChild(null) threw exception TypeError: Type error.
</ins><span class="cx"> PASS pi.appendChild(div) threw exception Error: HierarchyRequestError: DOM Exception 3.
</span><span class="cx"> PASS pi.appendChild(textNode) threw exception Error: HierarchyRequestError: DOM Exception 3.
</span><span class="cx"> PASS successfullyParsed is true
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomprocessinginstructionappendChildexceptionsxhtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/processing-instruction-appendChild-exceptions.xhtml (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/processing-instruction-appendChild-exceptions.xhtml        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/processing-instruction-appendChild-exceptions.xhtml        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -5,7 +5,7 @@
</span><span class="cx"> &lt;![CDATA[
</span><span class="cx"> description(&quot;Test that appropriate exceptions are thrown when adding children to a ProcessingInstruction.&quot;);
</span><span class="cx"> var pi = document.createProcessingInstruction('target', 'data');
</span><del>-shouldThrow(&quot;pi.appendChild(null)&quot;, &quot;'Error: HierarchyRequestError: DOM Exception 3'&quot;);
</del><ins>+shouldThrow(&quot;pi.appendChild(null)&quot;, &quot;'TypeError: Type error'&quot;);
</ins><span class="cx"> var div = document.createElement('div');
</span><span class="cx"> shouldThrow(&quot;pi.appendChild(div)&quot;, &quot;'Error: HierarchyRequestError: DOM Exception 3'&quot;);
</span><span class="cx"> var textNode = document.createTextNode('sometext');
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomtimerclearintervalinhandlerandgenerateerrorexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/timer-clear-interval-in-handler-and-generate-error-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/timer-clear-interval-in-handler-and-generate-error-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/dom/timer-clear-interval-in-handler-and-generate-error-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,2 +1,2 @@
</span><del>-CONSOLE MESSAGE: line 10: NotFoundError: DOM Exception 8: An attempt was made to reference a Node in a context where it does not exist.
</del><ins>+CONSOLE MESSAGE: line 10: TypeError: Type error
</ins><span class="cx"> 
</span></span></pre></div>
<a id="trunkLayoutTestsfasteventsremovetargetwithshadowindragexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/events/remove-target-with-shadow-in-drag-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/events/remove-target-with-shadow-in-drag-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/events/remove-target-with-shadow-in-drag-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,3 +1,3 @@
</span><del>-CONSOLE MESSAGE: line 34: NotFoundError: DOM Exception 8: An attempt was made to reference a Node in a context where it does not exist.
-CONSOLE MESSAGE: line 34: NotFoundError: DOM Exception 8: An attempt was made to reference a Node in a context where it does not exist.
</del><ins>+CONSOLE MESSAGE: line 34: TypeError: Type error
+CONSOLE MESSAGE: line 34: TypeError: Type error
</ins><span class="cx"> PASS. DRT didn't crash.
</span></span></pre></div>
<a id="trunkLayoutTestsfastinspectorsupportuncaughtdom8exceptionhtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/inspector-support/uncaught-dom8-exception.html (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/inspector-support/uncaught-dom8-exception.html        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/fast/inspector-support/uncaught-dom8-exception.html        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -6,7 +6,7 @@
</span><span class="cx"> {
</span><span class="cx">     if (window.testRunner)
</span><span class="cx">         testRunner.dumpAsText();
</span><del>-    document.appendChild();
</del><ins>+    document.body.removeAttributeNode(document.createAttribute(&quot;doesNotExist&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> &lt;/script&gt;
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/ChangeLog (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/ChangeLog        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/imported/w3c/ChangeLog        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,3 +1,21 @@
</span><ins>+2015-09-10  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Node.appendChild(null) / replaceChild(null, null) / removeChild(null) / insertBefore(null, ref) should throw a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=148971
+        &lt;rdar://problem/22560883&gt;
+        &lt;rdar://problem/22559225&gt;
+
+        Reviewed by Ryosuke Niwa.
+
+        Rebaseline W3C tests now that more checks are passing.
+
+        * web-platform-tests/dom/interfaces-expected.txt:
+        * web-platform-tests/dom/nodes/Node-appendChild-expected.txt:
+        * web-platform-tests/dom/nodes/Node-insertBefore-expected.txt:
+        * web-platform-tests/dom/nodes/Node-removeChild-expected.txt:
+        * web-platform-tests/dom/nodes/Node-replaceChild-expected.txt:
+        * web-platform-tests/html/dom/interfaces-expected.txt:
+
</ins><span class="cx"> 2015-09-09  Dewei Zhu  &lt;dewei_zhu@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Document.characterSet should return &quot;UTF-8&quot; by default.
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsdominterfacesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/dom/interfaces-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/dom/interfaces-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/dom/interfaces-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -634,21 +634,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: xmlDoc must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on xmlDoc with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on xmlDoc with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><del>-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</ins><span class="cx"> PASS Node interface: xmlDoc must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on xmlDoc with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on xmlDoc with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: xmlDoc must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on xmlDoc with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; did not throw
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on xmlDoc with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: xmlDoc must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on xmlDoc with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on xmlDoc with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: xmlDoc must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on xmlDoc with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span><span class="lines">@@ -793,21 +787,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: document.createDocumentFragment() must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on document.createDocumentFragment() with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on document.createDocumentFragment() with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><del>-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+}&quot; did not throw
</ins><span class="cx"> PASS Node interface: document.createDocumentFragment() must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on document.createDocumentFragment() with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on document.createDocumentFragment() with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.createDocumentFragment() must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on document.createDocumentFragment() with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; did not throw
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on document.createDocumentFragment() with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.createDocumentFragment() must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on document.createDocumentFragment() with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on document.createDocumentFragment() with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: document.createDocumentFragment() must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on document.createDocumentFragment() with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span><span class="lines">@@ -915,21 +903,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: document.doctype must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on document.doctype with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on document.doctype with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><span class="cx"> }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</span><span class="cx"> PASS Node interface: document.doctype must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on document.doctype with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on document.doctype with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.doctype must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on document.doctype with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on document.doctype with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.doctype must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on document.doctype with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on document.doctype with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: document.doctype must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on document.doctype with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span><span class="lines">@@ -1187,21 +1169,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: element must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on element with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on element with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><del>-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+}&quot; did not throw
</ins><span class="cx"> PASS Node interface: element must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on element with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on element with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: element must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on element with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; did not throw
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on element with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: element must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on element with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on element with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: element must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on element with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span><span class="lines">@@ -1409,21 +1385,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: document.createTextNode(&quot;abc&quot;) must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on document.createTextNode(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on document.createTextNode(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><span class="cx"> }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</span><span class="cx"> PASS Node interface: document.createTextNode(&quot;abc&quot;) must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on document.createTextNode(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on document.createTextNode(&quot;abc&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.createTextNode(&quot;abc&quot;) must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on document.createTextNode(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on document.createTextNode(&quot;abc&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.createTextNode(&quot;abc&quot;) must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on document.createTextNode(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on document.createTextNode(&quot;abc&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: document.createTextNode(&quot;abc&quot;) must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on document.createTextNode(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span><span class="lines">@@ -1543,21 +1513,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><span class="cx"> }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</span><span class="cx"> PASS Node interface: xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on xmlDoc.createProcessingInstruction(&quot;abc&quot;, &quot;def&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span><span class="lines">@@ -1673,21 +1637,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: document.createComment(&quot;abc&quot;) must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on document.createComment(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on document.createComment(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><span class="cx"> }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</span><span class="cx"> PASS Node interface: document.createComment(&quot;abc&quot;) must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on document.createComment(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on document.createComment(&quot;abc&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.createComment(&quot;abc&quot;) must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on document.createComment(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on document.createComment(&quot;abc&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.createComment(&quot;abc&quot;) must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on document.createComment(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on document.createComment(&quot;abc&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: document.createComment(&quot;abc&quot;) must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on document.createComment(&quot;abc&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsdomnodesNodeappendChildexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-appendChild-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-appendChild-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-appendChild-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,12 +1,12 @@
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-FAIL WebIDL tests assert_throws: function &quot;function () { document.body.appendChild(null) }&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS WebIDL tests 
</ins><span class="cx"> PASS Appending to a leaf node. 
</span><del>-FAIL Appending null to a text node assert_throws: function &quot;function () { node.appendChild(null) }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Appending null to a text node 
</ins><span class="cx"> PASS Appending to a text node 
</span><del>-FAIL Appending null to a comment assert_throws: function &quot;function () { node.appendChild(null) }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Appending null to a comment 
</ins><span class="cx"> PASS Appending to a comment 
</span><del>-FAIL Appending null to a doctype assert_throws: function &quot;function () { node.appendChild(null) }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Appending null to a doctype 
</ins><span class="cx"> PASS Appending to a doctype 
</span><span class="cx"> PASS Appending a document 
</span><span class="cx"> PASS Adopting an orphan 
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsdomnodesNodeinsertBeforeexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-insertBefore-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-insertBefore-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-insertBefore-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,12 +1,12 @@
</span><span class="cx"> 
</span><del>-FAIL Calling insertBefore with a non-Node first argument must throw TypeError. assert_throws: function &quot;function () { document.body.insertBefore(null, null) }&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
-FAIL Calling insertBefore with a non-Node first argument on a leaf node DocumentType must throw TypeError. assert_throws: function &quot;function () { node.insertBefore(null, null) }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Calling insertBefore with a non-Node first argument must throw TypeError. 
+PASS Calling insertBefore with a non-Node first argument on a leaf node DocumentType must throw TypeError. 
</ins><span class="cx"> PASS Calling insertBefore an a leaf node DocumentType must throw HIERARCHY_REQUEST_ERR. 
</span><del>-FAIL Calling insertBefore with a non-Node first argument on a leaf node Text must throw TypeError. assert_throws: function &quot;function () { node.insertBefore(null, null) }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Calling insertBefore with a non-Node first argument on a leaf node Text must throw TypeError. 
</ins><span class="cx"> PASS Calling insertBefore an a leaf node Text must throw HIERARCHY_REQUEST_ERR. 
</span><del>-FAIL Calling insertBefore with a non-Node first argument on a leaf node Comment must throw TypeError. assert_throws: function &quot;function () { node.insertBefore(null, null) }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Calling insertBefore with a non-Node first argument on a leaf node Comment must throw TypeError. 
</ins><span class="cx"> PASS Calling insertBefore an a leaf node Comment must throw HIERARCHY_REQUEST_ERR. 
</span><del>-FAIL Calling insertBefore with a non-Node first argument on a leaf node ProcessingInstruction must throw TypeError. assert_throws: function &quot;function () { node.insertBefore(null, null) }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Calling insertBefore with a non-Node first argument on a leaf node ProcessingInstruction must throw TypeError. 
</ins><span class="cx"> PASS Calling insertBefore an a leaf node ProcessingInstruction must throw HIERARCHY_REQUEST_ERR. 
</span><span class="cx"> PASS Calling insertBefore with an inclusive ancestor of the context object must throw HIERARCHY_REQUEST_ERR. 
</span><span class="cx"> PASS Calling insertBefore with a reference child whose parent is not the context node must throw a NotFoundError. 
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsdomnodesNoderemoveChildexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-removeChild-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-removeChild-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-removeChild-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -27,5 +27,5 @@
</span><span class="cx"> PASS Passing a detached comment from a synthetic document to removeChild should not affect it. 
</span><span class="cx"> PASS Passing a non-detached comment from a synthetic document to removeChild should not affect it. 
</span><span class="cx"> PASS Calling removeChild on a comment from a synthetic document with no children should throw NOT_FOUND_ERR. 
</span><del>-FAIL Passing a value that is not a Node reference to removeChild should throw TypeError. assert_throws: function &quot;function () { document.body.removeChild(null) }&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Passing a value that is not a Node reference to removeChild should throw TypeError. 
</ins><span class="cx"> b
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestsdomnodesNodereplaceChildexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-replaceChild-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-replaceChild-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/dom/nodes/Node-replaceChild-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,7 +1,5 @@
</span><span class="cx"> 
</span><del>-FAIL Passing null to replaceChild should throw a TypeError. assert_throws: function &quot;function () {
-    a.replaceChild(null, null);
-  }&quot; did not throw
</del><ins>+PASS Passing null to replaceChild should throw a TypeError. 
</ins><span class="cx"> FAIL If child's parent is not the context node, a NotFoundError exception should be thrown assert_throws: function &quot;function () {
</span><span class="cx">     a.replaceChild(a, c);
</span><span class="cx">   }&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; that is not a DOMException NotFoundError: property &quot;code&quot; is equal to 3, expected 8
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1225,21 +1225,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: iframe.contentDocument must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on iframe.contentDocument with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on iframe.contentDocument with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><del>-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</ins><span class="cx"> PASS Node interface: iframe.contentDocument must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on iframe.contentDocument with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on iframe.contentDocument with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: iframe.contentDocument must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on iframe.contentDocument with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; did not throw
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on iframe.contentDocument with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: iframe.contentDocument must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on iframe.contentDocument with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on iframe.contentDocument with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: iframe.contentDocument must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on iframe.contentDocument with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span><span class="lines">@@ -1551,21 +1545,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><del>-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+}&quot; threw object &quot;Error: HierarchyRequestError: DOM Exception 3&quot; (&quot;HierarchyRequestError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</ins><span class="cx"> PASS Node interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; did not throw
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span><span class="lines">@@ -2171,21 +2159,15 @@
</span><span class="cx">     [native code]
</span><span class="cx"> }&quot; did not throw
</span><span class="cx"> PASS Node interface: document.createElement(&quot;noscript&quot;) must inherit property &quot;insertBefore&quot; with the proper type (40) 
</span><del>-FAIL Node interface: calling insertBefore(Node,Node) on document.createElement(&quot;noscript&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</del><ins>+FAIL Node interface: calling insertBefore(Node,Node) on document.createElement(&quot;noscript&quot;) with too few arguments must throw TypeError assert_throws: Called with 1 arguments function &quot;function () {
</ins><span class="cx">     [native code]
</span><del>-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+}&quot; did not throw
</ins><span class="cx"> PASS Node interface: document.createElement(&quot;noscript&quot;) must inherit property &quot;appendChild&quot; with the proper type (41) 
</span><del>-FAIL Node interface: calling appendChild(Node) on document.createElement(&quot;noscript&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling appendChild(Node) on document.createElement(&quot;noscript&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.createElement(&quot;noscript&quot;) must inherit property &quot;replaceChild&quot; with the proper type (42) 
</span><del>-FAIL Node interface: calling replaceChild(Node,Node) on document.createElement(&quot;noscript&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; did not throw
</del><ins>+PASS Node interface: calling replaceChild(Node,Node) on document.createElement(&quot;noscript&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS Node interface: document.createElement(&quot;noscript&quot;) must inherit property &quot;removeChild&quot; with the proper type (43) 
</span><del>-FAIL Node interface: calling removeChild(Node) on document.createElement(&quot;noscript&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
-    [native code]
-}&quot; threw object &quot;Error: NotFoundError: DOM Exception 8&quot; (&quot;NotFoundError&quot;) expected object &quot;TypeError&quot; (&quot;TypeError&quot;)
</del><ins>+PASS Node interface: calling removeChild(Node) on document.createElement(&quot;noscript&quot;) with too few arguments must throw TypeError 
</ins><span class="cx"> PASS EventTarget interface: document.createElement(&quot;noscript&quot;) must inherit property &quot;addEventListener&quot; with the proper type (0) 
</span><span class="cx"> FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on document.createElement(&quot;noscript&quot;) with too few arguments must throw TypeError assert_throws: Called with 0 arguments function &quot;function () {
</span><span class="cx">     [native code]
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomdotnodebaseexceptionexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/dom/dot-node-base-exception-expected.txt (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/dot-node-base-exception-expected.txt        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/js/dom/dot-node-base-exception-expected.txt        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -3,7 +3,7 @@
</span><span class="cx"> On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-PASS (document.appendChild()).foobar() threw exception Error: NotFoundError: DOM Exception 8.
</del><ins>+PASS (document.appendChild()).foobar() threw exception TypeError: Type error.
</ins><span class="cx"> PASS successfullyParsed is true
</span><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomscripttestsdotnodebaseexceptionjs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/dom/script-tests/dot-node-base-exception.js (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/script-tests/dot-node-base-exception.js        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/LayoutTests/js/dom/script-tests/dot-node-base-exception.js        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -3,4 +3,4 @@
</span><span class="cx"> );
</span><span class="cx"> 
</span><span class="cx"> // Should be a DOM exception, not just some &quot;TypeError: Null value&quot;.
</span><del>-shouldThrow('(document.appendChild()).foobar()', '&quot;Error: NotFoundError: DOM Exception 8&quot;');
</del><ins>+shouldThrow('(document.appendChild()).foobar()', '&quot;TypeError: Type error&quot;');
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/ChangeLog        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,3 +1,35 @@
</span><ins>+2015-09-10  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Node.appendChild(null) / replaceChild(null, null) / removeChild(null) / insertBefore(null, ref) should throw a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=148971
+        &lt;rdar://problem/22560883&gt;
+        &lt;rdar://problem/22559225&gt;
+
+        Reviewed by Ryosuke Niwa.
+
+        Node.appendChild(null) / replaceChild(null, null) / removeChild(null)
+        and insertBefore(null, ref) should throw a TypeError instead of a
+        NotFoundError, as per the specification:
+        https://dom.spec.whatwg.org/#node
+
+        The parameters are not nullable so the Web IDL specification says
+        we should throw a TypeError in this case.
+
+        This patch moves the null-checking from ContainerNode to the methods
+        on Node. The null-checking is supposed to be done by the bindings code
+        but our generator currently does not support this so we do the null
+        checking as close to the bindings as possible. The bindings code is
+        calling the methods on Node. This also makes sure we throw a TypeError
+        for null-argument when the Node is not a ContainerNode. For e.g.
+        Text.appendChild(null) should throw a TypeError too.
+
+        The methods on ContainerNode now take references insteaad of pointer
+        parameters now that the null-checking is done at the call site in
+        Node. This lead to a lot of code update as those methods are used
+        a lot throughout the code base.
+
+        No new tests, already covered by pre-existing layout tests.
+
</ins><span class="cx"> 2015-09-10  Daniel Bates  &lt;dabates@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Write a test to ensure we don't regress processing of tasks when page defers loading
</span></span></pre></div>
<a id="trunkSourceWebCoreModulespluginsYouTubePluginReplacementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/Modules/plugins/YouTubePluginReplacement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/Modules/plugins/YouTubePluginReplacement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/Modules/plugins/YouTubePluginReplacement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -81,9 +81,9 @@
</span><span class="cx"> {
</span><span class="cx">     m_embedShadowElement = YouTubeEmbedShadowElement::create(m_parentElement-&gt;document());
</span><span class="cx"> 
</span><del>-    root-&gt;appendChild(m_embedShadowElement.get());
</del><ins>+    root-&gt;appendChild(*m_embedShadowElement);
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;HTMLIFrameElement&gt; iframeElement = HTMLIFrameElement::create(HTMLNames::iframeTag, m_parentElement-&gt;document());
</del><ins>+    Ref&lt;HTMLIFrameElement&gt; iframeElement = HTMLIFrameElement::create(HTMLNames::iframeTag, m_parentElement-&gt;document());
</ins><span class="cx">     if (m_attributes.contains(&quot;width&quot;))
</span><span class="cx">         iframeElement-&gt;setAttribute(HTMLNames::widthAttr, AtomicString(&quot;100%&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx">     
</span><span class="lines">@@ -98,7 +98,7 @@
</span><span class="cx">     
</span><span class="cx">     // Disable frame flattening for this iframe.
</span><span class="cx">     iframeElement-&gt;setAttribute(HTMLNames::scrollingAttr, AtomicString(&quot;no&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    m_embedShadowElement-&gt;appendChild(iframeElement);
</del><ins>+    m_embedShadowElement-&gt;appendChild(WTF::move(iframeElement));
</ins><span class="cx"> 
</span><span class="cx">     return true;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsobjcDOMHTMLmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/objc/DOMHTML.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/objc/DOMHTML.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/bindings/objc/DOMHTML.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -152,7 +152,7 @@
</span><span class="cx"> - (DOMDocumentFragment *)createDocumentFragmentWithText:(NSString *)text
</span><span class="cx"> {
</span><span class="cx">     // FIXME: Since this is not a contextual fragment, it won't handle whitespace properly.
</span><del>-    return kit(createFragmentFromText(core(self)-&gt;createRange(), text).get());
</del><ins>+    return kit(createFragmentFromText(core(self)-&gt;createRange(), text).ptr());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> @end
</span></span></pre></div>
<a id="trunkSourceWebCoredomAttrcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Attr.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Attr.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Attr.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -138,11 +138,11 @@
</span><span class="cx">     setValue(v, ec);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; Attr::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</del><ins>+Ref&lt;Node&gt; Attr::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;Attr&gt; clone = adoptRef(new Attr(targetDocument, qualifiedName(), value()));
-    cloneChildNodes(clone.get());
-    return clone.release();
</del><ins>+    Ref&lt;Attr&gt; clone = adoptRef(*new Attr(targetDocument, qualifiedName(), value()));
+    cloneChildNodes(clone);
+    return WTF::move(clone);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // DOM Section 1.1.1
</span></span></pre></div>
<a id="trunkSourceWebCoredomAttrh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Attr.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Attr.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Attr.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -80,7 +80,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual String nodeValue() const override { return value(); }
</span><span class="cx">     virtual void setNodeValue(const String&amp;, ExceptionCode&amp;) override;
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx"> 
</span><span class="cx">     virtual bool isAttributeNode() const override { return true; }
</span><span class="cx">     virtual bool childTypeAllowed(NodeType) const override;
</span></span></pre></div>
<a id="trunkSourceWebCoredomCDATASectioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/CDATASection.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/CDATASection.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/CDATASection.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx">     return CDATA_SECTION_NODE;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; CDATASection::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</del><ins>+Ref&lt;Node&gt; CDATASection::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</ins><span class="cx"> {
</span><span class="cx">     return create(targetDocument, data());
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoredomCDATASectionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/CDATASection.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/CDATASection.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/CDATASection.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual String nodeName() const override;
</span><span class="cx">     virtual NodeType nodeType() const override;
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx">     virtual bool childTypeAllowed(NodeType) const override;
</span><span class="cx">     virtual Ref&lt;Text&gt; virtualCreate(const String&amp;) override;
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCoredomCommentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Comment.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Comment.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Comment.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx">     return COMMENT_NODE;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; Comment::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</del><ins>+Ref&lt;Node&gt; Comment::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</ins><span class="cx"> {
</span><span class="cx">     return create(targetDocument, data());
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoredomCommenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Comment.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Comment.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Comment.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual String nodeName() const override;
</span><span class="cx">     virtual NodeType nodeType() const override;
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx">     virtual bool childTypeAllowed(NodeType) const override;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoredomContainerNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ContainerNode.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ContainerNode.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/ContainerNode.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -76,7 +76,7 @@
</span><span class="cx">     if (!is&lt;DocumentFragment&gt;(node)) {
</span><span class="cx">         nodes.append(node);
</span><span class="cx">         if (ContainerNode* oldParent = node.parentNode())
</span><del>-            oldParent-&gt;removeChild(&amp;node, ec);
</del><ins>+            oldParent-&gt;removeChild(node, ec);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -146,13 +146,13 @@
</span><span class="cx">     removeDetachedChildren();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static inline bool isChildTypeAllowed(ContainerNode* newParent, Node* child)
</del><ins>+static inline bool isChildTypeAllowed(ContainerNode&amp; newParent, Node&amp; child)
</ins><span class="cx"> {
</span><del>-    if (!child-&gt;isDocumentFragment())
-        return newParent-&gt;childTypeAllowed(child-&gt;nodeType());
</del><ins>+    if (!child.isDocumentFragment())
+        return newParent.childTypeAllowed(child.nodeType());
</ins><span class="cx"> 
</span><del>-    for (Node* node = child-&gt;firstChild(); node; node = node-&gt;nextSibling()) {
-        if (!newParent-&gt;childTypeAllowed(node-&gt;nodeType()))
</del><ins>+    for (Node* node = child.firstChild(); node; node = node-&gt;nextSibling()) {
+        if (!newParent.childTypeAllowed(node-&gt;nodeType()))
</ins><span class="cx">             return false;
</span><span class="cx">     }
</span><span class="cx">     return true;
</span><span class="lines">@@ -169,23 +169,19 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static inline bool containsConsideringHostElements(const Node* newChild, const Node* newParent)
</del><ins>+static inline bool containsConsideringHostElements(const Node&amp; newChild, const Node&amp; newParent)
</ins><span class="cx"> {
</span><del>-    return (newParent-&gt;isInShadowTree() || isInTemplateContent(newParent))
-        ? newChild-&gt;containsIncludingHostElements(newParent)
-        : newChild-&gt;contains(newParent);
</del><ins>+    return (newParent.isInShadowTree() || isInTemplateContent(&amp;newParent))
+        ? newChild.containsIncludingHostElements(&amp;newParent)
+        : newChild.contains(&amp;newParent);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-static inline ExceptionCode checkAcceptChild(ContainerNode* newParent, Node* newChild, Node* oldChild)
</del><ins>+static inline ExceptionCode checkAcceptChild(ContainerNode&amp; newParent, Node&amp; newChild, Node* oldChild)
</ins><span class="cx"> {
</span><del>-    // Not mentioned in spec: throw NOT_FOUND_ERR if newChild is null
-    if (!newChild)
-        return NOT_FOUND_ERR;
-
</del><span class="cx">     // Use common case fast path if possible.
</span><del>-    if ((newChild-&gt;isElementNode() || newChild-&gt;isTextNode()) &amp;&amp; newParent-&gt;isElementNode()) {
-        ASSERT(!newParent-&gt;isReadOnlyNode());
-        ASSERT(!newParent-&gt;isDocumentTypeNode());
</del><ins>+    if ((newChild.isElementNode() || newChild.isTextNode()) &amp;&amp; newParent.isElementNode()) {
+        ASSERT(!newParent.isReadOnlyNode());
+        ASSERT(!newParent.isDocumentTypeNode());
</ins><span class="cx">         ASSERT(isChildTypeAllowed(newParent, newChild));
</span><span class="cx">         if (containsConsideringHostElements(newChild, newParent))
</span><span class="cx">             return HIERARCHY_REQUEST_ERR;
</span><span class="lines">@@ -193,17 +189,17 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // This should never happen, but also protect release builds from tree corruption.
</span><del>-    ASSERT(!newChild-&gt;isPseudoElement());
-    if (newChild-&gt;isPseudoElement())
</del><ins>+    ASSERT(!newChild.isPseudoElement());
+    if (newChild.isPseudoElement())
</ins><span class="cx">         return HIERARCHY_REQUEST_ERR;
</span><span class="cx"> 
</span><del>-    if (newParent-&gt;isReadOnlyNode())
</del><ins>+    if (newParent.isReadOnlyNode())
</ins><span class="cx">         return NO_MODIFICATION_ALLOWED_ERR;
</span><span class="cx">     if (containsConsideringHostElements(newChild, newParent))
</span><span class="cx">         return HIERARCHY_REQUEST_ERR;
</span><span class="cx"> 
</span><del>-    if (oldChild &amp;&amp; is&lt;Document&gt;(*newParent)) {
-        if (!downcast&lt;Document&gt;(*newParent).canReplaceChild(newChild, oldChild))
</del><ins>+    if (oldChild &amp;&amp; is&lt;Document&gt;(newParent)) {
+        if (!downcast&lt;Document&gt;(newParent).canReplaceChild(newChild, *oldChild))
</ins><span class="cx">             return HIERARCHY_REQUEST_ERR;
</span><span class="cx">     } else if (!isChildTypeAllowed(newParent, newChild))
</span><span class="cx">         return HIERARCHY_REQUEST_ERR;
</span><span class="lines">@@ -211,12 +207,12 @@
</span><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static inline bool checkAcceptChildGuaranteedNodeTypes(ContainerNode* newParent, Node* newChild, ExceptionCode&amp; ec)
</del><ins>+static inline bool checkAcceptChildGuaranteedNodeTypes(ContainerNode&amp; newParent, Node&amp; newChild, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><del>-    ASSERT(!newParent-&gt;isReadOnlyNode());
-    ASSERT(!newParent-&gt;isDocumentTypeNode());
</del><ins>+    ASSERT(!newParent.isReadOnlyNode());
+    ASSERT(!newParent.isDocumentTypeNode());
</ins><span class="cx">     ASSERT(isChildTypeAllowed(newParent, newChild));
</span><del>-    if (newChild-&gt;contains(newParent)) {
</del><ins>+    if (newChild.contains(&amp;newParent)) {
</ins><span class="cx">         ec = HIERARCHY_REQUEST_ERR;
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="lines">@@ -224,25 +220,19 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static inline bool checkAddChild(ContainerNode* newParent, Node* newChild, ExceptionCode&amp; ec)
</del><ins>+static inline bool checkAddChild(ContainerNode&amp; newParent, Node&amp; newChild, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><del>-    ec = checkAcceptChild(newParent, newChild, 0);
-    if (ec)
-        return false;
-
-    return true;
</del><ins>+    ec = checkAcceptChild(newParent, newChild, nullptr);
+    return !ec;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-static inline bool checkReplaceChild(ContainerNode* newParent, Node* newChild, Node* oldChild, ExceptionCode&amp; ec)
</del><ins>+static inline bool checkReplaceChild(ContainerNode&amp; newParent, Node&amp; newChild, Node&amp; oldChild, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><del>-    ec = checkAcceptChild(newParent, newChild, oldChild);
-    if (ec)
-        return false;
-
-    return true;
</del><ins>+    ec = checkAcceptChild(newParent, newChild, &amp;oldChild);
+    return !ec;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ContainerNode::insertBefore(PassRefPtr&lt;Node&gt; newChild, Node* refChild, ExceptionCode&amp; ec)
</del><ins>+bool ContainerNode::insertBefore(Ref&lt;Node&gt;&amp;&amp; newChild, Node* refChild, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><span class="cx">     // Check that this node is not &quot;floating&quot;.
</span><span class="cx">     // If it is, it can be deleted as a side effect of sending mutation events.
</span><span class="lines">@@ -254,10 +244,10 @@
</span><span class="cx"> 
</span><span class="cx">     // insertBefore(node, 0) is equivalent to appendChild(node)
</span><span class="cx">     if (!refChild)
</span><del>-        return appendChild(newChild, ec);
</del><ins>+        return appendChild(WTF::move(newChild), ec);
</ins><span class="cx"> 
</span><span class="cx">     // Make sure adding the new child is OK.
</span><del>-    if (!checkAddChild(this, newChild.get(), ec))
</del><ins>+    if (!checkAddChild(*this, newChild, ec))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     // NOT_FOUND_ERR: Raised if refChild is not a child of this node
</span><span class="lines">@@ -266,20 +256,20 @@
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (refChild-&gt;previousSibling() == newChild || refChild == newChild) // nothing to do
</del><ins>+    if (refChild-&gt;previousSibling() == newChild.ptr() || refChild == newChild.ptr()) // nothing to do
</ins><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="cx">     Ref&lt;Node&gt; next(*refChild);
</span><span class="cx"> 
</span><span class="cx">     NodeVector targets;
</span><del>-    collectChildrenAndRemoveFromOldParent(*newChild.get(), targets, ec);
</del><ins>+    collectChildrenAndRemoveFromOldParent(newChild, targets, ec);
</ins><span class="cx">     if (ec)
</span><span class="cx">         return false;
</span><span class="cx">     if (targets.isEmpty())
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="cx">     // We need this extra check because collectChildrenAndRemoveFromOldParent() can fire mutation events.
</span><del>-    if (!checkAcceptChildGuaranteedNodeTypes(this, newChild.get(), ec))
</del><ins>+    if (!checkAcceptChildGuaranteedNodeTypes(*this, newChild, ec))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     InspectorInstrumentation::willInsertDOMNode(document(), *this);
</span><span class="lines">@@ -390,7 +380,7 @@
</span><span class="cx">     newChild-&gt;setNeedsStyleRecalc(ReconstructRenderTree);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ContainerNode::replaceChild(PassRefPtr&lt;Node&gt; newChild, Node* oldChild, ExceptionCode&amp; ec)
</del><ins>+bool ContainerNode::replaceChild(Ref&lt;Node&gt;&amp;&amp; newChild, Node&amp; oldChild, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><span class="cx">     // Check that this node is not &quot;floating&quot;.
</span><span class="cx">     // If it is, it can be deleted as a side effect of sending mutation events.
</span><span class="lines">@@ -400,48 +390,43 @@
</span><span class="cx"> 
</span><span class="cx">     ec = 0;
</span><span class="cx"> 
</span><del>-    if (oldChild == newChild) // nothing to do
</del><ins>+    if (&amp;oldChild == newChild.ptr()) // nothing to do
</ins><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    if (!oldChild) {
-        ec = NOT_FOUND_ERR;
-        return false;
-    }
-
</del><span class="cx">     // Make sure replacing the old child with the new is ok
</span><del>-    if (!checkReplaceChild(this, newChild.get(), oldChild, ec))
</del><ins>+    if (!checkReplaceChild(*this, newChild, oldChild, ec))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     // NOT_FOUND_ERR: Raised if oldChild is not a child of this node.
</span><del>-    if (oldChild-&gt;parentNode() != this) {
</del><ins>+    if (oldChild.parentNode() != this) {
</ins><span class="cx">         ec = NOT_FOUND_ERR;
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ChildListMutationScope mutation(*this);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Node&gt; next = oldChild-&gt;nextSibling();
</del><ins>+    RefPtr&lt;Node&gt; next = oldChild.nextSibling();
</ins><span class="cx"> 
</span><span class="cx">     // Remove the node we're replacing
</span><del>-    Ref&lt;Node&gt; removedChild(*oldChild);
</del><ins>+    Ref&lt;Node&gt; removedChild(oldChild);
</ins><span class="cx">     removeChild(oldChild, ec);
</span><span class="cx">     if (ec)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    if (next &amp;&amp; (next-&gt;previousSibling() == newChild || next == newChild)) // nothing to do
</del><ins>+    if (next &amp;&amp; (next-&gt;previousSibling() == newChild.ptr() || next == newChild.ptr())) // nothing to do
</ins><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="cx">     // Does this one more time because removeChild() fires a MutationEvent.
</span><del>-    if (!checkReplaceChild(this, newChild.get(), oldChild, ec))
</del><ins>+    if (!checkReplaceChild(*this, newChild, oldChild, ec))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     NodeVector targets;
</span><del>-    collectChildrenAndRemoveFromOldParent(*newChild.get(), targets, ec);
</del><ins>+    collectChildrenAndRemoveFromOldParent(newChild, targets, ec);
</ins><span class="cx">     if (ec)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     // Does this yet another check because collectChildrenAndRemoveFromOldParent() fires a MutationEvent.
</span><del>-    if (!checkReplaceChild(this, newChild.get(), oldChild, ec))
</del><ins>+    if (!checkReplaceChild(*this, newChild, oldChild, ec))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     InspectorInstrumentation::willInsertDOMNode(document(), *this);
</span><span class="lines">@@ -515,7 +500,7 @@
</span><span class="cx">     disconnectSubframesIfNeeded(*this, RootAndDescendants);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ContainerNode::removeChild(Node* oldChild, ExceptionCode&amp; ec)
</del><ins>+bool ContainerNode::removeChild(Node&amp; oldChild, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><span class="cx">     // Check that this node is not &quot;floating&quot;.
</span><span class="cx">     // If it is, it can be deleted as a side effect of sending mutation events.
</span><span class="lines">@@ -532,12 +517,12 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // NOT_FOUND_ERR: Raised if oldChild is not a child of this node.
</span><del>-    if (!oldChild || oldChild-&gt;parentNode() != this) {
</del><ins>+    if (oldChild.parentNode() != this) {
</ins><span class="cx">         ec = NOT_FOUND_ERR;
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    Ref&lt;Node&gt; child(*oldChild);
</del><ins>+    Ref&lt;Node&gt; child(oldChild);
</ins><span class="cx"> 
</span><span class="cx">     document().removeFocusedNodeOfSubtree(child.ptr());
</span><span class="cx"> 
</span><span class="lines">@@ -670,7 +655,7 @@
</span><span class="cx">     dispatchSubtreeModifiedEvent();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ContainerNode::appendChild(PassRefPtr&lt;Node&gt; newChild, ExceptionCode&amp; ec)
</del><ins>+bool ContainerNode::appendChild(Ref&lt;Node&gt;&amp;&amp; newChild, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><span class="cx">     Ref&lt;ContainerNode&gt; protect(*this);
</span><span class="cx"> 
</span><span class="lines">@@ -681,14 +666,14 @@
</span><span class="cx">     ec = 0;
</span><span class="cx"> 
</span><span class="cx">     // Make sure adding the new child is ok
</span><del>-    if (!checkAddChild(this, newChild.get(), ec))
</del><ins>+    if (!checkAddChild(*this, newChild, ec))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    if (newChild == m_lastChild) // nothing to do
-        return newChild;
</del><ins>+    if (newChild.ptr() == m_lastChild) // nothing to do
+        return true;
</ins><span class="cx"> 
</span><span class="cx">     NodeVector targets;
</span><del>-    collectChildrenAndRemoveFromOldParent(*newChild.get(), targets, ec);
</del><ins>+    collectChildrenAndRemoveFromOldParent(newChild, targets, ec);
</ins><span class="cx">     if (ec)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -696,7 +681,7 @@
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="cx">     // We need this extra check because collectChildrenAndRemoveFromOldParent() can fire mutation events.
</span><del>-    if (!checkAcceptChildGuaranteedNodeTypes(this, newChild.get(), ec))
</del><ins>+    if (!checkAcceptChildGuaranteedNodeTypes(*this, newChild, ec))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     InspectorInstrumentation::willInsertDOMNode(document(), *this);
</span><span class="lines">@@ -759,16 +744,16 @@
</span><span class="cx">     invalidateNodeListAndCollectionCachesInAncestors();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void ContainerNode::cloneChildNodes(ContainerNode* clone)
</del><ins>+void ContainerNode::cloneChildNodes(ContainerNode&amp; clone)
</ins><span class="cx"> {
</span><span class="cx">     ExceptionCode ec = 0;
</span><del>-    Document&amp; targetDocument = clone-&gt;document();
</del><ins>+    Document&amp; targetDocument = clone.document();
</ins><span class="cx">     for (Node* child = firstChild(); child &amp;&amp; !ec; child = child-&gt;nextSibling()) {
</span><del>-        RefPtr&lt;Node&gt; clonedChild = child-&gt;cloneNodeInternal(targetDocument, CloningOperation::SelfWithTemplateContent);
-        clone-&gt;appendChild(clonedChild, ec);
</del><ins>+        Ref&lt;Node&gt; clonedChild = child-&gt;cloneNodeInternal(targetDocument, CloningOperation::SelfWithTemplateContent);
+        clone.appendChild(clonedChild.copyRef(), ec);
</ins><span class="cx"> 
</span><del>-        if (!ec &amp;&amp; is&lt;ContainerNode&gt;(child))
-            downcast&lt;ContainerNode&gt;(child)-&gt;cloneChildNodes(downcast&lt;ContainerNode&gt;(clonedChild.get()));
</del><ins>+        if (!ec &amp;&amp; is&lt;ContainerNode&gt;(*child))
+            downcast&lt;ContainerNode&gt;(*child).cloneChildNodes(downcast&lt;ContainerNode&gt;(clonedChild.get()));
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -947,7 +932,7 @@
</span><span class="cx">     if (ec || !node)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    appendChild(node.release(), ec);
</del><ins>+    appendChild(node.releaseNonNull(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ContainerNode::prepend(Vector&lt;NodeOrString&gt;&amp;&amp; nodeOrStringVector, ExceptionCode&amp; ec)
</span><span class="lines">@@ -956,7 +941,7 @@
</span><span class="cx">     if (ec || !node)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    insertBefore(node.release(), firstChild(), ec);
</del><ins>+    insertBefore(node.releaseNonNull(), firstChild(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> HTMLCollection* ContainerNode::cachedHTMLCollection(CollectionType type)
</span></span></pre></div>
<a id="trunkSourceWebCoredomContainerNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ContainerNode.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ContainerNode.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/ContainerNode.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -102,10 +102,10 @@
</span><span class="cx">     WEBCORE_EXPORT unsigned countChildNodes() const;
</span><span class="cx">     WEBCORE_EXPORT Node* traverseToChildAt(unsigned) const;
</span><span class="cx"> 
</span><del>-    bool insertBefore(PassRefPtr&lt;Node&gt; newChild, Node* refChild, ExceptionCode&amp; = ASSERT_NO_EXCEPTION);
-    bool replaceChild(PassRefPtr&lt;Node&gt; newChild, Node* oldChild, ExceptionCode&amp; = ASSERT_NO_EXCEPTION);
-    WEBCORE_EXPORT bool removeChild(Node* child, ExceptionCode&amp; = ASSERT_NO_EXCEPTION);
-    WEBCORE_EXPORT bool appendChild(PassRefPtr&lt;Node&gt; newChild, ExceptionCode&amp; = ASSERT_NO_EXCEPTION);
</del><ins>+    bool insertBefore(Ref&lt;Node&gt;&amp;&amp; newChild, Node* refChild, ExceptionCode&amp; = ASSERT_NO_EXCEPTION);
+    bool replaceChild(Ref&lt;Node&gt;&amp;&amp; newChild, Node&amp; oldChild, ExceptionCode&amp; = ASSERT_NO_EXCEPTION);
+    WEBCORE_EXPORT bool removeChild(Node&amp; child, ExceptionCode&amp; = ASSERT_NO_EXCEPTION);
+    WEBCORE_EXPORT bool appendChild(Ref&lt;Node&gt;&amp;&amp; newChild, ExceptionCode&amp; = ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     // These methods are only used during parsing.
</span><span class="cx">     // They don't send DOM mutation events or handle reparenting.
</span><span class="lines">@@ -117,7 +117,7 @@
</span><span class="cx">     void removeChildren();
</span><span class="cx">     void takeAllChildrenFrom(ContainerNode*);
</span><span class="cx"> 
</span><del>-    void cloneChildNodes(ContainerNode* clone);
</del><ins>+    void cloneChildNodes(ContainerNode&amp; clone);
</ins><span class="cx"> 
</span><span class="cx">     enum ChildChangeType { ElementInserted, ElementRemoved, TextInserted, TextRemoved, TextChanged, AllChildrenRemoved, NonContentsChildChanged };
</span><span class="cx">     enum ChildChangeSource { ChildChangeSourceParser, ChildChangeSourceAPI };
</span></span></pre></div>
<a id="trunkSourceWebCoredomDOMImplementationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/DOMImplementation.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/DOMImplementation.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/DOMImplementation.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -231,9 +231,9 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (doctype)
</span><del>-        doc-&gt;appendChild(doctype);
</del><ins>+        doc-&gt;appendChild(*doctype);
</ins><span class="cx">     if (documentElement)
</span><del>-        doc-&gt;appendChild(documentElement.release());
</del><ins>+        doc-&gt;appendChild(documentElement.releaseNonNull());
</ins><span class="cx"> 
</span><span class="cx">     return doc;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Document.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Document.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Document.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1009,7 +1009,7 @@
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">         if (source-&gt;parentNode()) {
</span><del>-            source-&gt;parentNode()-&gt;removeChild(source.get(), ec);
</del><ins>+            source-&gt;parentNode()-&gt;removeChild(*source, ec);
</ins><span class="cx">             if (ec)
</span><span class="cx">                 return nullptr;
</span><span class="cx">         }
</span><span class="lines">@@ -1547,7 +1547,7 @@
</span><span class="cx">         if (!headElement)
</span><span class="cx">             return;
</span><span class="cx">         m_titleElement = createElement(titleTag, false);
</span><del>-        headElement-&gt;appendChild(m_titleElement, ASSERT_NO_EXCEPTION);
</del><ins>+        headElement-&gt;appendChild(*m_titleElement, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // The DOM API has no method of specifying direction, so assume LTR.
</span><span class="lines">@@ -2518,11 +2518,10 @@
</span><span class="cx">         newBody = downcast&lt;HTMLElement&gt;(node.get());
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    HTMLElement* b = bodyOrFrameset();
-    if (!b)
-        documentElement()-&gt;appendChild(newBody.release(), ec);
</del><ins>+    if (auto* body = bodyOrFrameset())
+        documentElement()-&gt;replaceChild(newBody.releaseNonNull(), *body, ec);
</ins><span class="cx">     else
</span><del>-        documentElement()-&gt;replaceChild(newBody.release(), b, ec);
</del><ins>+        documentElement()-&gt;appendChild(newBody.releaseNonNull(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> HTMLHeadElement* Document::head()
</span><span class="lines">@@ -3326,22 +3325,18 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool Document::canReplaceChild(Node* newChild, Node* oldChild)
</del><ins>+bool Document::canReplaceChild(Node&amp; newChild, Node&amp; oldChild)
</ins><span class="cx"> {
</span><del>-    if (!oldChild)
-        // ContainerNode::replaceChild will raise a NOT_FOUND_ERR.
</del><ins>+    if (oldChild.nodeType() == newChild.nodeType())
</ins><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    if (oldChild-&gt;nodeType() == newChild-&gt;nodeType())
-        return true;
-
</del><span class="cx">     int numDoctypes = 0;
</span><span class="cx">     int numElements = 0;
</span><span class="cx"> 
</span><span class="cx">     // First, check how many doctypes and elements we have, not counting
</span><span class="cx">     // the child we're about to remove.
</span><span class="cx">     for (Node* c = firstChild(); c; c = c-&gt;nextSibling()) {
</span><del>-        if (c == oldChild)
</del><ins>+        if (c == &amp;oldChild)
</ins><span class="cx">             continue;
</span><span class="cx">         
</span><span class="cx">         switch (c-&gt;nodeType()) {
</span><span class="lines">@@ -3357,8 +3352,8 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     // Then, see how many doctypes and elements might be added by the new child.
</span><del>-    if (newChild-&gt;isDocumentFragment()) {
-        for (Node* c = newChild-&gt;firstChild(); c; c = c-&gt;nextSibling()) {
</del><ins>+    if (newChild.isDocumentFragment()) {
+        for (Node* c = newChild.firstChild(); c; c = c-&gt;nextSibling()) {
</ins><span class="cx">             switch (c-&gt;nodeType()) {
</span><span class="cx">             case ATTRIBUTE_NODE:
</span><span class="cx">             case CDATA_SECTION_NODE:
</span><span class="lines">@@ -3381,7 +3376,7 @@
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">     } else {
</span><del>-        switch (newChild-&gt;nodeType()) {
</del><ins>+        switch (newChild.nodeType()) {
</ins><span class="cx">         case ATTRIBUTE_NODE:
</span><span class="cx">         case CDATA_SECTION_NODE:
</span><span class="cx">         case DOCUMENT_FRAGMENT_NODE:
</span><span class="lines">@@ -3409,7 +3404,7 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; Document::cloneNodeInternal(Document&amp;, CloningOperation type)
</del><ins>+Ref&lt;Node&gt; Document::cloneNodeInternal(Document&amp;, CloningOperation type)
</ins><span class="cx"> {
</span><span class="cx">     Ref&lt;Document&gt; clone = cloneDocumentWithoutChildren();
</span><span class="cx">     clone-&gt;cloneDataFromDocument(*this);
</span><span class="lines">@@ -3418,7 +3413,7 @@
</span><span class="cx">     case CloningOperation::SelfWithTemplateContent:
</span><span class="cx">         break;
</span><span class="cx">     case CloningOperation::Everything:
</span><del>-        cloneChildNodes(clone.ptr());
</del><ins>+        cloneChildNodes(clone);
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     return WTF::move(clone);
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Document.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Document.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Document.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -746,7 +746,7 @@
</span><span class="cx">     void nodeChildrenWillBeRemoved(ContainerNode&amp;);
</span><span class="cx">     // nodeWillBeRemoved is only safe when removing one node at a time.
</span><span class="cx">     void nodeWillBeRemoved(Node&amp;);
</span><del>-    bool canReplaceChild(Node* newChild, Node* oldChild);
</del><ins>+    bool canReplaceChild(Node&amp; newChild, Node&amp; oldChild);
</ins><span class="cx"> 
</span><span class="cx">     void textInserted(Node*, unsigned offset, unsigned length);
</span><span class="cx">     void textRemoved(Node*, unsigned offset, unsigned length);
</span><span class="lines">@@ -1310,7 +1310,7 @@
</span><span class="cx">     virtual String nodeName() const override final;
</span><span class="cx">     virtual NodeType nodeType() const override final;
</span><span class="cx">     virtual bool childTypeAllowed(NodeType) const override final;
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override final;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override final;
</ins><span class="cx">     void cloneDataFromDocument(const Document&amp;);
</span><span class="cx"> 
</span><span class="cx">     virtual void refScriptExecutionContext() override final { ref(); }
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentFragmentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/DocumentFragment.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/DocumentFragment.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/DocumentFragment.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -67,18 +67,18 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; DocumentFragment::cloneNodeInternal(Document&amp; targetDocument, CloningOperation type)
</del><ins>+Ref&lt;Node&gt; DocumentFragment::cloneNodeInternal(Document&amp; targetDocument, CloningOperation type)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;DocumentFragment&gt; clone = create(targetDocument);
</del><ins>+    Ref&lt;DocumentFragment&gt; clone = create(targetDocument);
</ins><span class="cx">     switch (type) {
</span><span class="cx">     case CloningOperation::OnlySelf:
</span><span class="cx">     case CloningOperation::SelfWithTemplateContent:
</span><span class="cx">         break;
</span><span class="cx">     case CloningOperation::Everything:
</span><del>-        cloneChildNodes(clone.get());
</del><ins>+        cloneChildNodes(clone);
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><del>-    return clone;
</del><ins>+    return WTF::move(clone);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void DocumentFragment::parseHTML(const String&amp; source, Element* contextElement, ParserContentPolicy parserContentPolicy)
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentFragmenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/DocumentFragment.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/DocumentFragment.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/DocumentFragment.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -48,7 +48,7 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     virtual NodeType nodeType() const override final;
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx">     virtual bool childTypeAllowed(NodeType) const override;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentTypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/DocumentType.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/DocumentType.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/DocumentType.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -51,7 +51,7 @@
</span><span class="cx">     return DOCUMENT_TYPE_NODE;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; DocumentType::cloneNodeInternal(Document&amp; documentTarget, CloningOperation)
</del><ins>+Ref&lt;Node&gt; DocumentType::cloneNodeInternal(Document&amp; documentTarget, CloningOperation)
</ins><span class="cx"> {
</span><span class="cx">     return create(documentTarget, m_name, m_publicId, m_systemId);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/DocumentType.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/DocumentType.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/DocumentType.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -52,7 +52,7 @@
</span><span class="cx">     virtual URL baseURI() const override;
</span><span class="cx">     virtual String nodeName() const override;
</span><span class="cx">     virtual NodeType nodeType() const override;
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx"> 
</span><span class="cx">     String m_name;
</span><span class="cx">     String m_publicId;
</span></span></pre></div>
<a id="trunkSourceWebCoredomElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Element.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Element.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Element.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -312,38 +312,37 @@
</span><span class="cx">     EventDispatcher::dispatchSimulatedClick(this, underlyingEvent, eventOptions, visualOptions);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; Element::cloneNodeInternal(Document&amp; targetDocument, CloningOperation type)
</del><ins>+Ref&lt;Node&gt; Element::cloneNodeInternal(Document&amp; targetDocument, CloningOperation type)
</ins><span class="cx"> {
</span><span class="cx">     switch (type) {
</span><span class="cx">     case CloningOperation::OnlySelf:
</span><span class="cx">     case CloningOperation::SelfWithTemplateContent:
</span><span class="cx">         return cloneElementWithoutChildren(targetDocument);
</span><span class="cx">     case CloningOperation::Everything:
</span><del>-        return cloneElementWithChildren(targetDocument);
</del><ins>+        break;
</ins><span class="cx">     }
</span><del>-    ASSERT_NOT_REACHED();
-    return nullptr;
</del><ins>+    return cloneElementWithChildren(targetDocument);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Element&gt; Element::cloneElementWithChildren(Document&amp; targetDocument)
</del><ins>+Ref&lt;Element&gt; Element::cloneElementWithChildren(Document&amp; targetDocument)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;Element&gt; clone = cloneElementWithoutChildren(targetDocument);
-    cloneChildNodes(clone.get());
-    return clone.release();
</del><ins>+    Ref&lt;Element&gt; clone = cloneElementWithoutChildren(targetDocument);
+    cloneChildNodes(clone);
+    return clone;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Element&gt; Element::cloneElementWithoutChildren(Document&amp; targetDocument)
</del><ins>+Ref&lt;Element&gt; Element::cloneElementWithoutChildren(Document&amp; targetDocument)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;Element&gt; clone = cloneElementWithoutAttributesAndChildren(targetDocument);
</del><ins>+    Ref&lt;Element&gt; clone = cloneElementWithoutAttributesAndChildren(targetDocument);
</ins><span class="cx">     // This will catch HTML elements in the wrong namespace that are not correctly copied.
</span><span class="cx">     // This is a sanity check as HTML overloads some of the DOM methods.
</span><span class="cx">     ASSERT(isHTMLElement() == clone-&gt;isHTMLElement());
</span><span class="cx"> 
</span><span class="cx">     clone-&gt;cloneDataFromElement(*this);
</span><del>-    return clone.release();
</del><ins>+    return clone;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Element&gt; Element::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</del><ins>+Ref&lt;Element&gt; Element::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</ins><span class="cx"> {
</span><span class="cx">     return targetDocument.createElement(tagQName(), false);
</span><span class="cx"> }
</span><span class="lines">@@ -2319,7 +2318,7 @@
</span><span class="cx">     if (ec)
</span><span class="cx">         return;
</span><span class="cx">     
</span><del>-    parent-&gt;replaceChild(fragment.release(), this, ec);
</del><ins>+    parent-&gt;replaceChild(fragment.releaseNonNull(), *this, ec);
</ins><span class="cx">     RefPtr&lt;Node&gt; node = next ? next-&gt;previousSibling() : nullptr;
</span><span class="cx">     if (!ec &amp;&amp; is&lt;Text&gt;(node.get()))
</span><span class="cx">         mergeWithNextTextNode(downcast&lt;Text&gt;(*node), ec);
</span><span class="lines">@@ -2338,7 +2337,7 @@
</span><span class="cx">             container = downcast&lt;HTMLTemplateElement&gt;(*this).content();
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-        replaceChildrenWithFragment(*container, fragment.release(), ec);
</del><ins>+        replaceChildrenWithFragment(*container, fragment.releaseNonNull(), ec);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoredomElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Element.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Element.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Element.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -201,8 +201,8 @@
</span><span class="cx"> 
</span><span class="cx">     virtual String nodeName() const override;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; cloneElementWithChildren(Document&amp;);
-    RefPtr&lt;Element&gt; cloneElementWithoutChildren(Document&amp;);
</del><ins>+    Ref&lt;Element&gt; cloneElementWithChildren(Document&amp;);
+    Ref&lt;Element&gt; cloneElementWithoutChildren(Document&amp;);
</ins><span class="cx"> 
</span><span class="cx">     void normalizeAttributes();
</span><span class="cx">     String nodeNamePreservingCase() const;
</span><span class="lines">@@ -563,8 +563,8 @@
</span><span class="cx"> 
</span><span class="cx">     // cloneNode is private so that non-virtual cloneElementWithChildren and cloneElementWithoutChildren
</span><span class="cx">     // are used instead.
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
-    virtual RefPtr&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;);
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
+    virtual Ref&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;);
</ins><span class="cx"> 
</span><span class="cx">     void addShadowRoot(Ref&lt;ShadowRoot&gt;&amp;&amp;);
</span><span class="cx">     void removeShadowRoot();
</span></span></pre></div>
<a id="trunkSourceWebCoredomEntityReferencecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/EntityReference.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/EntityReference.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/EntityReference.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx">     return ENTITY_REFERENCE_NODE;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; EntityReference::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</del><ins>+Ref&lt;Node&gt; EntityReference::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</ins><span class="cx"> {
</span><span class="cx">     return create(targetDocument, m_entityName);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoredomEntityReferenceh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/EntityReference.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/EntityReference.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/EntityReference.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -35,7 +35,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual String nodeName() const override;
</span><span class="cx">     virtual NodeType nodeType() const override;
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx"> 
</span><span class="cx">     String m_entityName;
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCoredomNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Node.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Node.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Node.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -429,38 +429,54 @@
</span><span class="cx"> 
</span><span class="cx"> bool Node::insertBefore(PassRefPtr&lt;Node&gt; newChild, Node* refChild, ExceptionCode&amp; ec)
</span><span class="cx"> {
</span><ins>+    if (!newChild) {
+        ec = TypeError;
+        return false;
+    }
</ins><span class="cx">     if (!is&lt;ContainerNode&gt;(*this)) {
</span><span class="cx">         ec = HIERARCHY_REQUEST_ERR;
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><del>-    return downcast&lt;ContainerNode&gt;(*this).insertBefore(newChild, refChild, ec);
</del><ins>+    return downcast&lt;ContainerNode&gt;(*this).insertBefore(*newChild, refChild, ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool Node::replaceChild(PassRefPtr&lt;Node&gt; newChild, Node* oldChild, ExceptionCode&amp; ec)
</span><span class="cx"> {
</span><ins>+    if (!newChild || !oldChild) {
+        ec = TypeError;
+        return false;
+    }
</ins><span class="cx">     if (!is&lt;ContainerNode&gt;(*this)) {
</span><span class="cx">         ec = HIERARCHY_REQUEST_ERR;
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><del>-    return downcast&lt;ContainerNode&gt;(*this).replaceChild(newChild, oldChild, ec);
</del><ins>+    return downcast&lt;ContainerNode&gt;(*this).replaceChild(*newChild, *oldChild, ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool Node::removeChild(Node* oldChild, ExceptionCode&amp; ec)
</span><span class="cx"> {
</span><ins>+    if (!oldChild) {
+        ec = TypeError;
+        return false;
+    }
</ins><span class="cx">     if (!is&lt;ContainerNode&gt;(*this)) {
</span><span class="cx">         ec = NOT_FOUND_ERR;
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><del>-    return downcast&lt;ContainerNode&gt;(*this).removeChild(oldChild, ec);
</del><ins>+    return downcast&lt;ContainerNode&gt;(*this).removeChild(*oldChild, ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool Node::appendChild(PassRefPtr&lt;Node&gt; newChild, ExceptionCode&amp; ec)
</span><span class="cx"> {
</span><ins>+    if (!newChild) {
+        ec = TypeError;
+        return false;
+    }
</ins><span class="cx">     if (!is&lt;ContainerNode&gt;(*this)) {
</span><span class="cx">         ec = HIERARCHY_REQUEST_ERR;
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><del>-    return downcast&lt;ContainerNode&gt;(*this).appendChild(newChild, ec);
</del><ins>+    return downcast&lt;ContainerNode&gt;(*this).appendChild(*newChild, ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static HashSet&lt;RefPtr&lt;Node&gt;&gt; nodeSetPreTransformedFromNodeOrStringVector(const Vector&lt;NodeOrString&gt;&amp; nodeOrStringVector)
</span><span class="lines">@@ -515,7 +531,7 @@
</span><span class="cx">     else
</span><span class="cx">         viablePreviousSibling = parent-&gt;firstChild();
</span><span class="cx"> 
</span><del>-    parent-&gt;insertBefore(node.release(), viablePreviousSibling.get(), ec);
</del><ins>+    parent-&gt;insertBefore(node.releaseNonNull(), viablePreviousSibling.get(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Node::after(Vector&lt;NodeOrString&gt;&amp;&amp; nodeOrStringVector, ExceptionCode&amp; ec)
</span><span class="lines">@@ -531,7 +547,7 @@
</span><span class="cx">     if (ec || !node)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    parent-&gt;insertBefore(node.release(), viableNextSibling.get(), ec);
</del><ins>+    parent-&gt;insertBefore(node.releaseNonNull(), viableNextSibling.get(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Node::replaceWith(Vector&lt;NodeOrString&gt;&amp;&amp; nodeOrStringVector, ExceptionCode&amp; ec)
</span><span class="lines">@@ -548,15 +564,15 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     if (parentNode() == parent)
</span><del>-        parent-&gt;replaceChild(node.release(), this, ec);
</del><ins>+        parent-&gt;replaceChild(node.releaseNonNull(), *this, ec);
</ins><span class="cx">     else
</span><del>-        parent-&gt;insertBefore(node.release(), viableNextSibling.get(), ec);
</del><ins>+        parent-&gt;insertBefore(node.releaseNonNull(), viableNextSibling.get(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Node::remove(ExceptionCode&amp; ec)
</span><span class="cx"> {
</span><span class="cx">     if (ContainerNode* parent = parentNode())
</span><del>-        parent-&gt;removeChild(this, ec);
</del><ins>+        parent-&gt;removeChild(*this, ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Node::normalize()
</span></span></pre></div>
<a id="trunkSourceWebCoredomNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Node.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Node.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Node.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -201,8 +201,8 @@
</span><span class="cx">         SelfWithTemplateContent,
</span><span class="cx">         Everything,
</span><span class="cx">     };
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) = 0;
-    RefPtr&lt;Node&gt; cloneNode(bool deep) { return cloneNodeInternal(document(), deep ? CloningOperation::Everything : CloningOperation::OnlySelf); }
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) = 0;
+    Ref&lt;Node&gt; cloneNode(bool deep) { return cloneNodeInternal(document(), deep ? CloningOperation::Everything : CloningOperation::OnlySelf); }
</ins><span class="cx"> 
</span><span class="cx">     virtual const AtomicString&amp; localName() const;
</span><span class="cx">     virtual const AtomicString&amp; namespaceURI() const;
</span></span></pre></div>
<a id="trunkSourceWebCoredomProcessingInstructioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ProcessingInstruction.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ProcessingInstruction.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/ProcessingInstruction.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx">     return PROCESSING_INSTRUCTION_NODE;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; ProcessingInstruction::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</del><ins>+Ref&lt;Node&gt; ProcessingInstruction::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</ins><span class="cx"> {
</span><span class="cx">     // FIXME: Is it a problem that this does not copy m_localHref?
</span><span class="cx">     // What about other data members?
</span></span></pre></div>
<a id="trunkSourceWebCoredomProcessingInstructionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ProcessingInstruction.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ProcessingInstruction.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/ProcessingInstruction.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -58,7 +58,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual String nodeName() const override;
</span><span class="cx">     virtual NodeType nodeType() const override;
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx"> 
</span><span class="cx">     virtual InsertionNotificationRequest insertedInto(ContainerNode&amp;) override;
</span><span class="cx">     virtual void removedFrom(ContainerNode&amp;) override;
</span></span></pre></div>
<a id="trunkSourceWebCoredomRangecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Range.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Range.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Range.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -665,7 +665,7 @@
</span><span class="cx">     // (or just delete the stuff in between)
</span><span class="cx"> 
</span><span class="cx">     if ((action == Extract || action == Clone) &amp;&amp; leftContents)
</span><del>-        fragment-&gt;appendChild(leftContents, ec);
</del><ins>+        fragment-&gt;appendChild(*leftContents, ec);
</ins><span class="cx"> 
</span><span class="cx">     if (processStart) {
</span><span class="cx">         NodeVector nodes;
</span><span class="lines">@@ -675,7 +675,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if ((action == Extract || action == Clone) &amp;&amp; rightContents)
</span><del>-        fragment-&gt;appendChild(rightContents, ec);
</del><ins>+        fragment-&gt;appendChild(*rightContents, ec);
</ins><span class="cx"> 
</span><span class="cx">     return fragment;
</span><span class="cx"> }
</span><span class="lines">@@ -702,7 +702,7 @@
</span><span class="cx">         endOffset = std::min(endOffset, static_cast&lt;CharacterData*&gt;(container)-&gt;length());
</span><span class="cx">         startOffset = std::min(startOffset, endOffset);
</span><span class="cx">         if (action == Extract || action == Clone) {
</span><del>-            RefPtr&lt;CharacterData&gt; c = static_pointer_cast&lt;CharacterData&gt;(container-&gt;cloneNode(true));
</del><ins>+            RefPtr&lt;CharacterData&gt; c = static_cast&lt;CharacterData*&gt;(container-&gt;cloneNode(true).ptr());
</ins><span class="cx">             deleteCharacterData(c, startOffset, endOffset, ec);
</span><span class="cx">             if (fragment) {
</span><span class="cx">                 result = fragment;
</span><span class="lines">@@ -717,7 +717,7 @@
</span><span class="cx">         endOffset = std::min(endOffset, static_cast&lt;ProcessingInstruction*&gt;(container)-&gt;data().length());
</span><span class="cx">         startOffset = std::min(startOffset, endOffset);
</span><span class="cx">         if (action == Extract || action == Clone) {
</span><del>-            RefPtr&lt;ProcessingInstruction&gt; c = static_pointer_cast&lt;ProcessingInstruction&gt;(container-&gt;cloneNode(true));
</del><ins>+            RefPtr&lt;ProcessingInstruction&gt; c = static_cast&lt;ProcessingInstruction*&gt;(container-&gt;cloneNode(true).ptr());
</ins><span class="cx">             c-&gt;setData(c-&gt;data().substring(startOffset, endOffset - startOffset), ec);
</span><span class="cx">             if (fragment) {
</span><span class="cx">                 result = fragment;
</span><span class="lines">@@ -935,7 +935,7 @@
</span><span class="cx">             return;
</span><span class="cx">         
</span><span class="cx">         container = &amp;startContainer();
</span><del>-        container-&gt;parentNode()-&gt;insertBefore(newNode.release(), newText.get(), ec);
</del><ins>+        container-&gt;parentNode()-&gt;insertBefore(newNode.releaseNonNull(), newText.get(), ec);
</ins><span class="cx">         if (ec)
</span><span class="cx">             return;
</span><span class="cx"> 
</span><span class="lines">@@ -1303,7 +1303,7 @@
</span><span class="cx"> 
</span><span class="cx">     ec = 0;
</span><span class="cx">     while (Node* n = newParent-&gt;firstChild()) {
</span><del>-        downcast&lt;ContainerNode&gt;(*newParent).removeChild(n, ec);
</del><ins>+        downcast&lt;ContainerNode&gt;(*newParent).removeChild(*n, ec);
</ins><span class="cx">         if (ec)
</span><span class="cx">             return;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceWebCoredomShadowRootcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ShadowRoot.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ShadowRoot.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/ShadowRoot.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (RefPtr&lt;DocumentFragment&gt; fragment = createFragmentForInnerOuterHTML(markup, host(), AllowScriptingContent, ec))
</span><del>-        replaceChildrenWithFragment(*this, fragment.release(), ec);
</del><ins>+        replaceChildrenWithFragment(*this, fragment.releaseNonNull(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool ShadowRoot::childTypeAllowed(NodeType type) const
</span><span class="lines">@@ -131,9 +131,10 @@
</span><span class="cx">     invalidateDistribution();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; ShadowRoot::cloneNodeInternal(Document&amp;, CloningOperation)
</del><ins>+Ref&lt;Node&gt; ShadowRoot::cloneNodeInternal(Document&amp;, CloningOperation)
</ins><span class="cx"> {
</span><del>-    return nullptr; // ShadowRoots should never be cloned.
</del><ins>+    RELEASE_ASSERT_NOT_REACHED();
+    return *static_cast&lt;Node*&gt;(nullptr); // ShadowRoots should never be cloned.
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ShadowRoot::removeAllEventListeners()
</span></span></pre></div>
<a id="trunkSourceWebCoredomShadowRooth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ShadowRoot.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ShadowRoot.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/ShadowRoot.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -76,7 +76,7 @@
</span><span class="cx">     virtual bool childTypeAllowed(NodeType) const override;
</span><span class="cx">     virtual void childrenChanged(const ChildChange&amp;) override;
</span><span class="cx"> 
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: This shouldn't happen. https://bugs.webkit.org/show_bug.cgi?id=88834
</span><span class="cx">     bool isOrphan() const { return !m_host; }
</span></span></pre></div>
<a id="trunkSourceWebCoredomTextcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Text.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Text.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Text.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx">     dispatchModifiedEvent(oldStr);
</span><span class="cx"> 
</span><span class="cx">     if (parentNode())
</span><del>-        parentNode()-&gt;insertBefore(newText.ptr(), nextSibling(), ec);
</del><ins>+        parentNode()-&gt;insertBefore(newText.copyRef(), nextSibling(), ec);
</ins><span class="cx">     if (ec)
</span><span class="cx">         return 0;
</span><span class="cx"> 
</span><span class="lines">@@ -132,28 +132,28 @@
</span><span class="cx">     RefPtr&lt;Text&gt; protectedThis(this); // Mutation event handlers could cause our last ref to go away
</span><span class="cx">     RefPtr&lt;ContainerNode&gt; parent = parentNode(); // Protect against mutation handlers moving this node during traversal
</span><span class="cx">     for (RefPtr&lt;Node&gt; n = startText; n &amp;&amp; n != this &amp;&amp; n-&gt;isTextNode() &amp;&amp; n-&gt;parentNode() == parent;) {
</span><del>-        RefPtr&lt;Node&gt; nodeToRemove(n.release());
</del><ins>+        Ref&lt;Node&gt; nodeToRemove(n.releaseNonNull());
</ins><span class="cx">         n = nodeToRemove-&gt;nextSibling();
</span><del>-        parent-&gt;removeChild(nodeToRemove.get(), IGNORE_EXCEPTION);
</del><ins>+        parent-&gt;removeChild(WTF::move(nodeToRemove), IGNORE_EXCEPTION);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (this != endText) {
</span><span class="cx">         Node* onePastEndText = endText-&gt;nextSibling();
</span><span class="cx">         for (RefPtr&lt;Node&gt; n = nextSibling(); n &amp;&amp; n != onePastEndText &amp;&amp; n-&gt;isTextNode() &amp;&amp; n-&gt;parentNode() == parent;) {
</span><del>-            RefPtr&lt;Node&gt; nodeToRemove(n.release());
</del><ins>+            Ref&lt;Node&gt; nodeToRemove(n.releaseNonNull());
</ins><span class="cx">             n = nodeToRemove-&gt;nextSibling();
</span><del>-            parent-&gt;removeChild(nodeToRemove.get(), IGNORE_EXCEPTION);
</del><ins>+            parent-&gt;removeChild(WTF::move(nodeToRemove), IGNORE_EXCEPTION);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (newText.isEmpty()) {
</span><span class="cx">         if (parent &amp;&amp; parentNode() == parent)
</span><del>-            parent-&gt;removeChild(this, IGNORE_EXCEPTION);
-        return 0;
</del><ins>+            parent-&gt;removeChild(*this, IGNORE_EXCEPTION);
+        return nullptr;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     setData(newText, IGNORE_EXCEPTION);
</span><del>-    return protectedThis.release();
</del><ins>+    return protectedThis;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> String Text::nodeName() const
</span><span class="lines">@@ -166,7 +166,7 @@
</span><span class="cx">     return TEXT_NODE;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; Text::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</del><ins>+Ref&lt;Node&gt; Text::cloneNodeInternal(Document&amp; targetDocument, CloningOperation)
</ins><span class="cx"> {
</span><span class="cx">     return create(targetDocument, data());
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoredomTexth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Text.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Text.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/dom/Text.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -62,7 +62,7 @@
</span><span class="cx"> private:
</span><span class="cx">     virtual String nodeName() const override;
</span><span class="cx">     virtual NodeType nodeType() const override;
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx">     virtual bool childTypeAllowed(NodeType) const override;
</span><span class="cx"> 
</span><span class="cx">     virtual Ref&lt;Text&gt; virtualCreate(const String&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingAppendNodeCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/AppendNodeCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/AppendNodeCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/AppendNodeCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -35,13 +35,12 @@
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><del>-AppendNodeCommand::AppendNodeCommand(PassRefPtr&lt;ContainerNode&gt; parent, PassRefPtr&lt;Node&gt; node, EditAction editingAction)
</del><ins>+AppendNodeCommand::AppendNodeCommand(PassRefPtr&lt;ContainerNode&gt; parent, Ref&lt;Node&gt;&amp;&amp; node, EditAction editingAction)
</ins><span class="cx">     : SimpleEditCommand(parent-&gt;document(), editingAction)
</span><span class="cx">     , m_parent(parent)
</span><del>-    , m_node(node)
</del><ins>+    , m_node(WTF::move(node))
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(m_parent);
</span><del>-    ASSERT(m_node);
</del><span class="cx">     ASSERT(!m_node-&gt;parentNode());
</span><span class="cx"> 
</span><span class="cx">     ASSERT(m_parent-&gt;hasEditableStyle() || !m_parent-&gt;renderer());
</span><span class="lines">@@ -68,10 +67,10 @@
</span><span class="cx">     if (!m_parent-&gt;hasEditableStyle() &amp;&amp; m_parent-&gt;renderer())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    m_parent-&gt;appendChild(m_node.get(), IGNORE_EXCEPTION);
</del><ins>+    m_parent-&gt;appendChild(m_node.copyRef(), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     if (shouldPostAccessibilityNotification())
</span><del>-        sendAXTextChangedIgnoringLineBreaks(m_node.get(), applyEditType());
</del><ins>+        sendAXTextChangedIgnoringLineBreaks(m_node.ptr(), applyEditType());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void AppendNodeCommand::doUnapply()
</span><span class="lines">@@ -81,7 +80,7 @@
</span><span class="cx"> 
</span><span class="cx">     // Need to notify this before actually deleting the text
</span><span class="cx">     if (shouldPostAccessibilityNotification())
</span><del>-        sendAXTextChangedIgnoringLineBreaks(m_node.get(), unapplyEditType());
</del><ins>+        sendAXTextChangedIgnoringLineBreaks(m_node.ptr(), unapplyEditType());
</ins><span class="cx"> 
</span><span class="cx">     m_node-&gt;remove(IGNORE_EXCEPTION);
</span><span class="cx"> }
</span><span class="lines">@@ -90,7 +89,7 @@
</span><span class="cx"> void AppendNodeCommand::getNodesInCommand(HashSet&lt;Node*&gt;&amp; nodes)
</span><span class="cx"> {
</span><span class="cx">     addNodeAndDescendants(m_parent.get(), nodes);
</span><del>-    addNodeAndDescendants(m_node.get(), nodes);
</del><ins>+    addNodeAndDescendants(m_node.ptr(), nodes);
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingAppendNodeCommandh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/AppendNodeCommand.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/AppendNodeCommand.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/AppendNodeCommand.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -32,13 +32,13 @@
</span><span class="cx"> 
</span><span class="cx"> class AppendNodeCommand : public SimpleEditCommand {
</span><span class="cx"> public:
</span><del>-    static Ref&lt;AppendNodeCommand&gt; create(PassRefPtr&lt;ContainerNode&gt; parent, PassRefPtr&lt;Node&gt; node, EditAction editingAction)
</del><ins>+    static Ref&lt;AppendNodeCommand&gt; create(PassRefPtr&lt;ContainerNode&gt; parent, Ref&lt;Node&gt;&amp;&amp; node, EditAction editingAction)
</ins><span class="cx">     {
</span><del>-        return adoptRef(*new AppendNodeCommand(parent, node, editingAction));
</del><ins>+        return adoptRef(*new AppendNodeCommand(parent, WTF::move(node), editingAction));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    AppendNodeCommand(PassRefPtr&lt;ContainerNode&gt; parent, PassRefPtr&lt;Node&gt;, EditAction);
</del><ins>+    AppendNodeCommand(PassRefPtr&lt;ContainerNode&gt; parent, Ref&lt;Node&gt;&amp;&amp;, EditAction);
</ins><span class="cx"> 
</span><span class="cx">     virtual void doApply() override;
</span><span class="cx">     virtual void doUnapply() override;
</span><span class="lines">@@ -48,7 +48,7 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;ContainerNode&gt; m_parent;
</span><del>-    RefPtr&lt;Node&gt; m_node;
</del><ins>+    Ref&lt;Node&gt; m_node;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingCompositeEditCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/CompositeEditCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/CompositeEditCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/CompositeEditCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -395,7 +395,8 @@
</span><span class="cx"> void CompositeEditCommand::appendNode(PassRefPtr&lt;Node&gt; node, PassRefPtr&lt;ContainerNode&gt; parent)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(canHaveChildrenForEditing(parent.get()));
</span><del>-    applyCommandToComposite(AppendNodeCommand::create(parent, node, editingAction()));
</del><ins>+    ASSERT(node);
+    applyCommandToComposite(AppendNodeCommand::create(parent, *node, editingAction()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CompositeEditCommand::removeChildrenInRange(PassRefPtr&lt;Node&gt; node, unsigned from, unsigned to)
</span><span class="lines">@@ -414,7 +415,7 @@
</span><span class="cx"> {
</span><span class="cx">     if (!node || !node-&gt;nonShadowBoundaryParentNode())
</span><span class="cx">         return;
</span><del>-    applyCommandToComposite(RemoveNodeCommand::create(node, shouldAssumeContentIsAlwaysEditable));
</del><ins>+    applyCommandToComposite(RemoveNodeCommand::create(*node, shouldAssumeContentIsAlwaysEditable));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CompositeEditCommand::removeNodePreservingChildren(PassRefPtr&lt;Node&gt; node, ShouldAssumeContentIsAlwaysEditable shouldAssumeContentIsAlwaysEditable)
</span><span class="lines">@@ -1541,7 +1542,7 @@
</span><span class="cx">     return node.release();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;Element&gt; createBlockPlaceholderElement(Document&amp; document)
</del><ins>+Ref&lt;Element&gt; createBlockPlaceholderElement(Document&amp; document)
</ins><span class="cx"> {
</span><span class="cx">     return document.createElement(brTag, false);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingDeleteSelectionCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -632,7 +632,7 @@
</span><span class="cx">     
</span><span class="cx">     // We need to merge into m_upstreamStart's block, but it's been emptied out and collapsed by deletion.
</span><span class="cx">     if (!mergeDestination.deepEquivalent().deprecatedNode() || !mergeDestination.deepEquivalent().deprecatedNode()-&gt;isDescendantOf(enclosingBlock(m_upstreamStart.containerNode())) || m_startsAtEmptyLine) {
</span><del>-        insertNodeAt(createBreakElement(document()).get(), m_upstreamStart);
</del><ins>+        insertNodeAt(createBreakElement(document()).ptr(), m_upstreamStart);
</ins><span class="cx">         mergeDestination = VisiblePosition(m_upstreamStart);
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -855,7 +855,7 @@
</span><span class="cx">     
</span><span class="cx">     removePreviouslySelectedEmptyTableRows();
</span><span class="cx">     
</span><del>-    RefPtr&lt;Node&gt; placeholder = m_needPlaceholder ? createBreakElement(document()).get() : 0;
</del><ins>+    RefPtr&lt;Node&gt; placeholder = m_needPlaceholder ? createBreakElement(document()).ptr() : nullptr;
</ins><span class="cx">     
</span><span class="cx">     if (placeholder) {
</span><span class="cx">         if (m_sanitizeMarkup)
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingEditorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/Editor.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/Editor.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/Editor.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -613,8 +613,8 @@
</span><span class="cx">             
</span><span class="cx">         RefPtr&lt;Range&gt; context = document().createRange();
</span><span class="cx">         context-&gt;selectNodeContents(elem, ec);
</span><del>-        RefPtr&lt;DocumentFragment&gt; fragment = createFragmentFromText(*context.get(), text);
-        elem-&gt;appendChild(fragment, ec);
</del><ins>+        Ref&lt;DocumentFragment&gt; fragment = createFragmentFromText(*context.get(), text);
+        elem-&gt;appendChild(WTF::move(fragment), ec);
</ins><span class="cx">     
</span><span class="cx">         // restore element to document
</span><span class="cx">         if (parent) {
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingEditorCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/EditorCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/EditorCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/EditorCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -165,11 +165,11 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static bool executeInsertNode(Frame&amp; frame, PassRefPtr&lt;Node&gt; content)
</del><ins>+static bool executeInsertNode(Frame&amp; frame, Ref&lt;Node&gt;&amp;&amp; content)
</ins><span class="cx"> {
</span><span class="cx">     RefPtr&lt;DocumentFragment&gt; fragment = DocumentFragment::create(*frame.document());
</span><span class="cx">     ExceptionCode ec = 0;
</span><del>-    fragment-&gt;appendChild(content, ec);
</del><ins>+    fragment-&gt;appendChild(WTF::move(content), ec);
</ins><span class="cx">     if (ec)
</span><span class="cx">         return false;
</span><span class="cx">     return executeInsertFragment(frame, fragment.release());
</span><span class="lines">@@ -464,10 +464,10 @@
</span><span class="cx"> 
</span><span class="cx"> static bool executeInsertHorizontalRule(Frame&amp; frame, Event*, EditorCommandSource, const String&amp; value)
</span><span class="cx"> {
</span><del>-    RefPtr&lt;HTMLHRElement&gt; rule = HTMLHRElement::create(*frame.document());
</del><ins>+    Ref&lt;HTMLHRElement&gt; rule = HTMLHRElement::create(*frame.document());
</ins><span class="cx">     if (!value.isEmpty())
</span><span class="cx">         rule-&gt;setIdAttribute(value);
</span><del>-    return executeInsertNode(frame, rule.release());
</del><ins>+    return executeInsertNode(frame, WTF::move(rule));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static bool executeInsertHTML(Frame&amp; frame, Event*, EditorCommandSource, const String&amp; value)
</span><span class="lines">@@ -478,9 +478,9 @@
</span><span class="cx"> static bool executeInsertImage(Frame&amp; frame, Event*, EditorCommandSource, const String&amp; value)
</span><span class="cx"> {
</span><span class="cx">     // FIXME: If userInterface is true, we should display a dialog box and let the user choose a local image.
</span><del>-    RefPtr&lt;HTMLImageElement&gt; image = HTMLImageElement::create(*frame.document());
</del><ins>+    Ref&lt;HTMLImageElement&gt; image = HTMLImageElement::create(*frame.document());
</ins><span class="cx">     image-&gt;setSrc(value);
</span><del>-    return executeInsertNode(frame, image.release());
</del><ins>+    return executeInsertNode(frame, WTF::move(image));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static bool executeInsertLineBreak(Frame&amp; frame, Event* event, EditorCommandSource source, const String&amp;)
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingInsertLineBreakCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/InsertLineBreakCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/InsertLineBreakCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/InsertLineBreakCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -129,7 +129,7 @@
</span><span class="cx">         
</span><span class="cx">         // Insert an extra br or '\n' if the just inserted one collapsed.
</span><span class="cx">         if (!isStartOfParagraph(positionBeforeNode(nodeToInsert.get())))
</span><del>-            insertNodeBefore(nodeToInsert-&gt;cloneNode(false).get(), nodeToInsert.get());
</del><ins>+            insertNodeBefore(nodeToInsert-&gt;cloneNode(false), nodeToInsert.get());
</ins><span class="cx">         
</span><span class="cx">         setEndingSelection(VisibleSelection(positionInParentAfterNode(nodeToInsert.get()), DOWNSTREAM, endingSelection().isDirectional()));
</span><span class="cx">     // If we're inserting after all of the rendered text in a text node, or into a non-text node,
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingInsertNodeBeforeCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/InsertNodeBeforeCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/InsertNodeBeforeCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/InsertNodeBeforeCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -55,7 +55,7 @@
</span><span class="cx">         return;
</span><span class="cx">     ASSERT(isEditableNode(*parent));
</span><span class="cx"> 
</span><del>-    parent-&gt;insertBefore(m_insertChild.get(), m_refChild.get(), IGNORE_EXCEPTION);
</del><ins>+    parent-&gt;insertBefore(*m_insertChild, m_refChild.get(), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     if (shouldPostAccessibilityNotification()) {
</span><span class="cx">         Position position = is&lt;Text&gt;(m_insertChild.get()) ? Position(downcast&lt;Text&gt;(m_insertChild.get()), 0) : createLegacyEditingPosition(m_insertChild.get(), 0);
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingInsertParagraphSeparatorCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -368,7 +368,7 @@
</span><span class="cx">     // created.  All of the nodes, starting at visiblePos, are about to be added to the new paragraph 
</span><span class="cx">     // element.  If the first node to be inserted won't be one that will hold an empty line open, add a br.
</span><span class="cx">     if (isEndOfParagraph(visiblePos) &amp;&amp; !lineBreakExistsAtVisiblePosition(visiblePos))
</span><del>-        appendNode(createBreakElement(document()).get(), blockToInsert.get());
</del><ins>+        appendNode(createBreakElement(document()), blockToInsert.get());
</ins><span class="cx"> 
</span><span class="cx">     // Move the start node and the siblings of the start node.
</span><span class="cx">     if (VisiblePosition(insertionPosition) != VisiblePosition(positionBeforeNode(blockToInsert.get()))) {
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingMergeIdenticalElementsCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -47,13 +47,13 @@
</span><span class="cx"> 
</span><span class="cx">     m_atChild = m_element2-&gt;firstChild();
</span><span class="cx"> 
</span><del>-    Vector&lt;RefPtr&lt;Node&gt;&gt; children;
</del><ins>+    Vector&lt;Ref&lt;Node&gt;&gt; children;
</ins><span class="cx">     for (Node* child = m_element1-&gt;firstChild(); child; child = child-&gt;nextSibling())
</span><del>-        children.append(child);
</del><ins>+        children.append(*child);
</ins><span class="cx"> 
</span><span class="cx">     size_t size = children.size();
</span><span class="cx">     for (size_t i = 0; i &lt; size; ++i)
</span><del>-        m_element2-&gt;insertBefore(children[i].release(), m_atChild.get(), IGNORE_EXCEPTION);
</del><ins>+        m_element2-&gt;insertBefore(WTF::move(children[i]), m_atChild.get(), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     m_element1-&gt;remove(IGNORE_EXCEPTION);
</span><span class="cx"> }
</span><span class="lines">@@ -71,17 +71,17 @@
</span><span class="cx"> 
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx"> 
</span><del>-    parent-&gt;insertBefore(m_element1.get(), m_element2.get(), ec);
</del><ins>+    parent-&gt;insertBefore(*m_element1, m_element2.get(), ec);
</ins><span class="cx">     if (ec)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    Vector&lt;RefPtr&lt;Node&gt;&gt; children;
</del><ins>+    Vector&lt;Ref&lt;Node&gt;&gt; children;
</ins><span class="cx">     for (Node* child = m_element2-&gt;firstChild(); child &amp;&amp; child != atChild; child = child-&gt;nextSibling())
</span><del>-        children.append(child);
</del><ins>+        children.append(*child);
</ins><span class="cx"> 
</span><span class="cx">     size_t size = children.size();
</span><span class="cx">     for (size_t i = 0; i &lt; size; ++i)
</span><del>-        m_element1-&gt;appendChild(children[i].release(), ec);
</del><ins>+        m_element1-&gt;appendChild(WTF::move(children[i]), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingRemoveNodeCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/RemoveNodeCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/RemoveNodeCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/RemoveNodeCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -34,12 +34,11 @@
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><del>-RemoveNodeCommand::RemoveNodeCommand(PassRefPtr&lt;Node&gt; node, ShouldAssumeContentIsAlwaysEditable shouldAssumeContentIsAlwaysEditable)
</del><ins>+RemoveNodeCommand::RemoveNodeCommand(Ref&lt;Node&gt;&amp;&amp; node, ShouldAssumeContentIsAlwaysEditable shouldAssumeContentIsAlwaysEditable)
</ins><span class="cx">     : SimpleEditCommand(node-&gt;document())
</span><del>-    , m_node(node)
</del><ins>+    , m_node(WTF::move(node))
</ins><span class="cx">     , m_shouldAssumeContentIsAlwaysEditable(shouldAssumeContentIsAlwaysEditable)
</span><span class="cx"> {
</span><del>-    ASSERT(m_node);
</del><span class="cx">     ASSERT(m_node-&gt;parentNode());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -64,7 +63,7 @@
</span><span class="cx">     if (!parent || !parent-&gt;hasEditableStyle())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    parent-&gt;insertBefore(m_node.get(), refChild.get(), IGNORE_EXCEPTION);
</del><ins>+    parent-&gt;insertBefore(m_node.copyRef(), refChild.get(), IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span><span class="lines">@@ -72,7 +71,7 @@
</span><span class="cx"> {
</span><span class="cx">     addNodeAndDescendants(m_parent.get(), nodes);
</span><span class="cx">     addNodeAndDescendants(m_refChild.get(), nodes);
</span><del>-    addNodeAndDescendants(m_node.get(), nodes);
</del><ins>+    addNodeAndDescendants(m_node.ptr(), nodes);
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingRemoveNodeCommandh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/RemoveNodeCommand.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/RemoveNodeCommand.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/RemoveNodeCommand.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -32,13 +32,13 @@
</span><span class="cx"> 
</span><span class="cx"> class RemoveNodeCommand : public SimpleEditCommand {
</span><span class="cx"> public:
</span><del>-    static Ref&lt;RemoveNodeCommand&gt; create(PassRefPtr&lt;Node&gt; node, ShouldAssumeContentIsAlwaysEditable shouldAssumeContentIsAlwaysEditable)
</del><ins>+    static Ref&lt;RemoveNodeCommand&gt; create(Ref&lt;Node&gt;&amp;&amp; node, ShouldAssumeContentIsAlwaysEditable shouldAssumeContentIsAlwaysEditable)
</ins><span class="cx">     {
</span><del>-        return adoptRef(*new RemoveNodeCommand(node, shouldAssumeContentIsAlwaysEditable));
</del><ins>+        return adoptRef(*new RemoveNodeCommand(WTF::move(node), shouldAssumeContentIsAlwaysEditable));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    explicit RemoveNodeCommand(PassRefPtr&lt;Node&gt;, ShouldAssumeContentIsAlwaysEditable);
</del><ins>+    RemoveNodeCommand(Ref&lt;Node&gt;&amp;&amp;, ShouldAssumeContentIsAlwaysEditable);
</ins><span class="cx"> 
</span><span class="cx">     virtual void doApply() override;
</span><span class="cx">     virtual void doUnapply() override;
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx">     void getNodesInCommand(HashSet&lt;Node*&gt;&amp;) override;
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Node&gt; m_node;
</del><ins>+    Ref&lt;Node&gt; m_node;
</ins><span class="cx">     RefPtr&lt;ContainerNode&gt; m_parent;
</span><span class="cx">     RefPtr&lt;Node&gt; m_refChild;
</span><span class="cx">     ShouldAssumeContentIsAlwaysEditable m_shouldAssumeContentIsAlwaysEditable;
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingReplaceNodeWithSpanCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -48,19 +48,19 @@
</span><span class="cx">     ASSERT(m_elementToReplace);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static void swapInNodePreservingAttributesAndChildren(HTMLElement* newNode, HTMLElement* nodeToReplace)
</del><ins>+static void swapInNodePreservingAttributesAndChildren(HTMLElement&amp; newNode, HTMLElement&amp; nodeToReplace)
</ins><span class="cx"> {
</span><del>-    ASSERT(nodeToReplace-&gt;inDocument());
-    RefPtr&lt;ContainerNode&gt; parentNode = nodeToReplace-&gt;parentNode();
</del><ins>+    ASSERT(nodeToReplace.inDocument());
+    RefPtr&lt;ContainerNode&gt; parentNode = nodeToReplace.parentNode();
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: Fix this to send the proper MutationRecords when MutationObservers are present.
</span><del>-    newNode-&gt;cloneDataFromElement(*nodeToReplace);
</del><ins>+    newNode.cloneDataFromElement(nodeToReplace);
</ins><span class="cx">     NodeVector children;
</span><del>-    getChildNodes(*nodeToReplace, children);
</del><ins>+    getChildNodes(nodeToReplace, children);
</ins><span class="cx">     for (auto&amp; child : children)
</span><del>-        newNode-&gt;appendChild(child.ptr(), ASSERT_NO_EXCEPTION);
</del><ins>+        newNode.appendChild(WTF::move(child), ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    parentNode-&gt;insertBefore(newNode, nodeToReplace, ASSERT_NO_EXCEPTION);
</del><ins>+    parentNode-&gt;insertBefore(newNode, &amp;nodeToReplace, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     parentNode-&gt;removeChild(nodeToReplace, ASSERT_NO_EXCEPTION);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -70,14 +70,14 @@
</span><span class="cx">         return;
</span><span class="cx">     if (!m_spanElement)
</span><span class="cx">         m_spanElement = createHTMLElement(m_elementToReplace-&gt;document(), spanTag);
</span><del>-    swapInNodePreservingAttributesAndChildren(m_spanElement.get(), m_elementToReplace.get());
</del><ins>+    swapInNodePreservingAttributesAndChildren(*m_spanElement, *m_elementToReplace);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ReplaceNodeWithSpanCommand::doUnapply()
</span><span class="cx"> {
</span><span class="cx">     if (!m_spanElement-&gt;inDocument())
</span><span class="cx">         return;
</span><del>-    swapInNodePreservingAttributesAndChildren(m_elementToReplace.get(), m_spanElement.get());
</del><ins>+    swapInNodePreservingAttributesAndChildren(*m_elementToReplace, *m_spanElement);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingReplaceSelectionCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -238,7 +238,7 @@
</span><span class="cx">     if (!parent)
</span><span class="cx">         return;
</span><span class="cx">     
</span><del>-    parent-&gt;removeChild(node.get(), ASSERT_NO_EXCEPTION);
</del><ins>+    parent-&gt;removeChild(*node, ASSERT_NO_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ReplacementFragment::insertNodeBefore(PassRefPtr&lt;Node&gt; node, Node* refNode)
</span><span class="lines">@@ -250,14 +250,14 @@
</span><span class="cx">     if (!parent)
</span><span class="cx">         return;
</span><span class="cx">         
</span><del>-    parent-&gt;insertBefore(node, refNode, ASSERT_NO_EXCEPTION);
</del><ins>+    parent-&gt;insertBefore(*node, refNode, ASSERT_NO_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> PassRefPtr&lt;StyledElement&gt; ReplacementFragment::insertFragmentForTestRendering(Node* rootEditableElement)
</span><span class="cx"> {
</span><span class="cx">     RefPtr&lt;StyledElement&gt; holder = createDefaultParagraphElement(document());
</span><span class="cx"> 
</span><del>-    holder-&gt;appendChild(m_fragment, ASSERT_NO_EXCEPTION);
</del><ins>+    holder-&gt;appendChild(*m_fragment, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     rootEditableElement-&gt;appendChild(holder.get(), ASSERT_NO_EXCEPTION);
</span><span class="cx">     document().updateLayoutIgnorePendingStylesheets();
</span><span class="cx"> 
</span><span class="lines">@@ -270,8 +270,8 @@
</span><span class="cx">         return;
</span><span class="cx">     
</span><span class="cx">     while (RefPtr&lt;Node&gt; node = holder-&gt;firstChild()) {
</span><del>-        holder-&gt;removeChild(node.get(), ASSERT_NO_EXCEPTION);
-        m_fragment-&gt;appendChild(node.get(), ASSERT_NO_EXCEPTION);
</del><ins>+        holder-&gt;removeChild(*node, ASSERT_NO_EXCEPTION);
+        m_fragment-&gt;appendChild(*node, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     removeNode(holder);
</span><span class="lines">@@ -1454,7 +1454,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     while (RefPtr&lt;Node&gt; listItem = listElement-&gt;firstChild()) {
</span><del>-        listElement-&gt;removeChild(listItem.get(), ASSERT_NO_EXCEPTION);
</del><ins>+        listElement-&gt;removeChild(*listItem, ASSERT_NO_EXCEPTION);
</ins><span class="cx">         if (isStart || isMiddle) {
</span><span class="cx">             insertNodeBefore(listItem, lastNode);
</span><span class="cx">             insertedNodes.respondToNodeInsertion(listItem.get());
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingSplitElementCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/SplitElementCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/SplitElementCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/SplitElementCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -47,16 +47,16 @@
</span><span class="cx">     if (m_atChild-&gt;parentNode() != m_element2)
</span><span class="cx">         return;
</span><span class="cx">     
</span><del>-    Vector&lt;RefPtr&lt;Node&gt;&gt; children;
</del><ins>+    Vector&lt;Ref&lt;Node&gt;&gt; children;
</ins><span class="cx">     for (Node* node = m_element2-&gt;firstChild(); node != m_atChild; node = node-&gt;nextSibling())
</span><del>-        children.append(node);
</del><ins>+        children.append(*node);
</ins><span class="cx">     
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     
</span><span class="cx">     ContainerNode* parent = m_element2-&gt;parentNode();
</span><span class="cx">     if (!parent || !parent-&gt;hasEditableStyle())
</span><span class="cx">         return;
</span><del>-    parent-&gt;insertBefore(m_element1.get(), m_element2.get(), ec);
</del><ins>+    parent-&gt;insertBefore(*m_element1, m_element2.get(), ec);
</ins><span class="cx">     if (ec)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx"> 
</span><span class="cx">     size_t size = children.size();
</span><span class="cx">     for (size_t i = 0; i &lt; size; ++i)
</span><del>-        m_element1-&gt;appendChild(children[i], ec);
</del><ins>+        m_element1-&gt;appendChild(WTF::move(children[i]), ec);
</ins><span class="cx"> }
</span><span class="cx">     
</span><span class="cx"> void SplitElementCommand::doApply()
</span><span class="lines">@@ -80,15 +80,15 @@
</span><span class="cx">     if (!m_element1 || !m_element1-&gt;hasEditableStyle() || !m_element2-&gt;hasEditableStyle())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    Vector&lt;RefPtr&lt;Node&gt;&gt; children;
</del><ins>+    Vector&lt;Ref&lt;Node&gt;&gt; children;
</ins><span class="cx">     for (Node* node = m_element1-&gt;firstChild(); node; node = node-&gt;nextSibling())
</span><del>-        children.append(node);
</del><ins>+        children.append(*node);
</ins><span class="cx"> 
</span><span class="cx">     RefPtr&lt;Node&gt; refChild = m_element2-&gt;firstChild();
</span><span class="cx"> 
</span><span class="cx">     size_t size = children.size();
</span><span class="cx">     for (size_t i = 0; i &lt; size; ++i)
</span><del>-        m_element2-&gt;insertBefore(children[i].get(), refChild.get(), IGNORE_EXCEPTION);
</del><ins>+        m_element2-&gt;insertBefore(WTF::move(children[i]), refChild.get(), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     // Recover the id attribute of the original element.
</span><span class="cx">     const AtomicString&amp; id = m_element1-&gt;getIdAttribute();
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingSplitTextNodeCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/SplitTextNodeCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/SplitTextNodeCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/SplitTextNodeCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -95,7 +95,7 @@
</span><span class="cx"> void SplitTextNodeCommand::insertText1AndTrimText2()
</span><span class="cx"> {
</span><span class="cx">     ExceptionCode ec = 0;
</span><del>-    m_text2-&gt;parentNode()-&gt;insertBefore(m_text1.get(), m_text2.get(), ec);
</del><ins>+    m_text2-&gt;parentNode()-&gt;insertBefore(*m_text1, m_text2.get(), ec);
</ins><span class="cx">     if (ec)
</span><span class="cx">         return;
</span><span class="cx">     m_text2-&gt;deleteData(0, m_offset, ec);
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingWrapContentsInDummySpanCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -40,15 +40,15 @@
</span><span class="cx"> 
</span><span class="cx"> void WrapContentsInDummySpanCommand::executeApply()
</span><span class="cx"> {
</span><del>-    Vector&lt;RefPtr&lt;Node&gt;&gt; children;
</del><ins>+    Vector&lt;Ref&lt;Node&gt;&gt; children;
</ins><span class="cx">     for (Node* child = m_element-&gt;firstChild(); child; child = child-&gt;nextSibling())
</span><del>-        children.append(child);
</del><ins>+        children.append(*child);
</ins><span class="cx"> 
</span><span class="cx">     size_t size = children.size();
</span><span class="cx">     for (size_t i = 0; i &lt; size; ++i)
</span><del>-        m_dummySpan-&gt;appendChild(children[i].release(), IGNORE_EXCEPTION);
</del><ins>+        m_dummySpan-&gt;appendChild(WTF::move(children[i]), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    m_element-&gt;appendChild(m_dummySpan.get(), IGNORE_EXCEPTION);
</del><ins>+    m_element-&gt;appendChild(*m_dummySpan, IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void WrapContentsInDummySpanCommand::doApply()
</span><span class="lines">@@ -65,13 +65,13 @@
</span><span class="cx">     if (!m_dummySpan || !m_element-&gt;hasEditableStyle())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    Vector&lt;RefPtr&lt;Node&gt;&gt; children;
</del><ins>+    Vector&lt;Ref&lt;Node&gt;&gt; children;
</ins><span class="cx">     for (Node* child = m_dummySpan-&gt;firstChild(); child; child = child-&gt;nextSibling())
</span><del>-        children.append(child);
</del><ins>+        children.append(*child);
</ins><span class="cx"> 
</span><span class="cx">     size_t size = children.size();
</span><span class="cx">     for (size_t i = 0; i &lt; size; ++i)
</span><del>-        m_element-&gt;appendChild(children[i].release(), IGNORE_EXCEPTION);
</del><ins>+        m_element-&gt;appendChild(WTF::move(children[i]), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     m_dummySpan-&gt;remove(IGNORE_EXCEPTION);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingcocoaEditorCocoamm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/cocoa/EditorCocoa.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/cocoa/EditorCocoa.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/cocoa/EditorCocoa.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -56,16 +56,16 @@
</span><span class="cx">     if (!typingStyle || !typingStyle-&gt;style())
</span><span class="cx">         return &amp;position.deprecatedNode()-&gt;renderer()-&gt;style();
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; styleElement = frame-&gt;document()-&gt;createElement(HTMLNames::spanTag, false);
</del><ins>+    Ref&lt;Element&gt; styleElement = frame-&gt;document()-&gt;createElement(HTMLNames::spanTag, false);
</ins><span class="cx"> 
</span><span class="cx">     String styleText = typingStyle-&gt;style()-&gt;asText() + &quot; display: inline&quot;;
</span><span class="cx">     styleElement-&gt;setAttribute(HTMLNames::styleAttr, styleText);
</span><span class="cx"> 
</span><span class="cx">     styleElement-&gt;appendChild(frame-&gt;document()-&gt;createEditingTextNode(&quot;&quot;), ASSERT_NO_EXCEPTION);
</span><span class="cx"> 
</span><del>-    position.deprecatedNode()-&gt;parentNode()-&gt;appendChild(styleElement, ASSERT_NO_EXCEPTION);
</del><ins>+    position.deprecatedNode()-&gt;parentNode()-&gt;appendChild(styleElement.copyRef(), ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    nodeToRemove = styleElement.get();
</del><ins>+    nodeToRemove = styleElement.ptr();
</ins><span class="cx"> 
</span><span class="cx">     frame-&gt;document()-&gt;updateStyleIfNeeded();
</span><span class="cx">     return styleElement-&gt;renderer() ? &amp;styleElement-&gt;renderer()-&gt;style() : nullptr;
</span></span></pre></div>
<a id="trunkSourceWebCoreeditinghtmleditingcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/htmlediting.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/htmlediting.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/htmlediting.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -899,20 +899,18 @@
</span><span class="cx">     return !childRenderer-&gt;nextSibling();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;HTMLElement&gt; createDefaultParagraphElement(Document&amp; document)
</del><ins>+Ref&lt;HTMLElement&gt; createDefaultParagraphElement(Document&amp; document)
</ins><span class="cx"> {
</span><span class="cx">     switch (document.frame()-&gt;editor().defaultParagraphSeparator()) {
</span><span class="cx">     case EditorParagraphSeparatorIsDiv:
</span><span class="cx">         return HTMLDivElement::create(document);
</span><span class="cx">     case EditorParagraphSeparatorIsP:
</span><del>-        return HTMLParagraphElement::create(document);
</del><ins>+        break;
</ins><span class="cx">     }
</span><del>-
-    ASSERT_NOT_REACHED();
-    return 0;
</del><ins>+    return HTMLParagraphElement::create(document);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;HTMLElement&gt; createBreakElement(Document&amp; document)
</del><ins>+Ref&lt;HTMLElement&gt; createBreakElement(Document&amp; document)
</ins><span class="cx"> {
</span><span class="cx">     return HTMLBRElement::create(document);
</span><span class="cx"> }
</span><span class="lines">@@ -971,7 +969,7 @@
</span><span class="cx">     return positionInParentBeforeNode(node);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;Element&gt; createTabSpanElement(Document&amp; document, PassRefPtr&lt;Node&gt; prpTabTextNode)
</del><ins>+Ref&lt;Element&gt; createTabSpanElement(Document&amp; document, PassRefPtr&lt;Node&gt; prpTabTextNode)
</ins><span class="cx"> {
</span><span class="cx">     RefPtr&lt;Node&gt; tabTextNode = prpTabTextNode;
</span><span class="cx"> 
</span><span class="lines">@@ -984,17 +982,17 @@
</span><span class="cx">     if (!tabTextNode)
</span><span class="cx">         tabTextNode = document.createEditingTextNode(&quot;\t&quot;);
</span><span class="cx"> 
</span><del>-    spanElement-&gt;appendChild(tabTextNode.release(), ASSERT_NO_EXCEPTION);
</del><ins>+    spanElement-&gt;appendChild(tabTextNode.releaseNonNull(), ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    return spanElement.release();
</del><ins>+    return spanElement.releaseNonNull();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;Element&gt; createTabSpanElement(Document&amp; document, const String&amp; tabText)
</del><ins>+Ref&lt;Element&gt; createTabSpanElement(Document&amp; document, const String&amp; tabText)
</ins><span class="cx"> {
</span><span class="cx">     return createTabSpanElement(document, document.createTextNode(tabText));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;Element&gt; createTabSpanElement(Document&amp; document)
</del><ins>+Ref&lt;Element&gt; createTabSpanElement(Document&amp; document)
</ins><span class="cx"> {
</span><span class="cx">     return createTabSpanElement(document, PassRefPtr&lt;Node&gt;());
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoreeditinghtmleditingh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/htmlediting.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/htmlediting.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/htmlediting.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -206,8 +206,8 @@
</span><span class="cx">     
</span><span class="cx"> // Functions returning HTMLElement
</span><span class="cx">     
</span><del>-WEBCORE_EXPORT PassRefPtr&lt;HTMLElement&gt; createDefaultParagraphElement(Document&amp;);
-PassRefPtr&lt;HTMLElement&gt; createBreakElement(Document&amp;);
</del><ins>+WEBCORE_EXPORT Ref&lt;HTMLElement&gt; createDefaultParagraphElement(Document&amp;);
+Ref&lt;HTMLElement&gt; createBreakElement(Document&amp;);
</ins><span class="cx"> PassRefPtr&lt;HTMLElement&gt; createOrderedListElement(Document&amp;);
</span><span class="cx"> PassRefPtr&lt;HTMLElement&gt; createUnorderedListElement(Document&amp;);
</span><span class="cx"> PassRefPtr&lt;HTMLElement&gt; createListItemElement(Document&amp;);
</span><span class="lines">@@ -222,10 +222,10 @@
</span><span class="cx"> // Element
</span><span class="cx"> // -------------------------------------------------------------------------
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;Element&gt; createTabSpanElement(Document&amp;);
-PassRefPtr&lt;Element&gt; createTabSpanElement(Document&amp;, PassRefPtr&lt;Node&gt; tabTextNode);
-PassRefPtr&lt;Element&gt; createTabSpanElement(Document&amp;, const String&amp; tabText);
-PassRefPtr&lt;Element&gt; createBlockPlaceholderElement(Document&amp;);
</del><ins>+Ref&lt;Element&gt; createTabSpanElement(Document&amp;);
+Ref&lt;Element&gt; createTabSpanElement(Document&amp;, PassRefPtr&lt;Node&gt; tabTextNode);
+Ref&lt;Element&gt; createTabSpanElement(Document&amp;, const String&amp; tabText);
+Ref&lt;Element&gt; createBlockPlaceholderElement(Document&amp;);
</ins><span class="cx"> 
</span><span class="cx"> Element* editableRootForPosition(const Position&amp;, EditableType = ContentIsEditable);
</span><span class="cx"> Element* unsplittableElementForPosition(const Position&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingiosEditorIOSmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/ios/EditorIOS.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/ios/EditorIOS.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/ios/EditorIOS.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -397,7 +397,7 @@
</span><span class="cx">     if (fragment) {
</span><span class="cx">         if (newFragment &amp;&amp; newFragment-&gt;firstChild()) {
</span><span class="cx">             ExceptionCode ec;
</span><del>-            fragment-&gt;appendChild(newFragment-&gt;firstChild(), ec);
</del><ins>+            fragment-&gt;appendChild(*newFragment-&gt;firstChild(), ec);
</ins><span class="cx">         }
</span><span class="cx">     } else
</span><span class="cx">         fragment = newFragment;
</span><span class="lines">@@ -494,12 +494,12 @@
</span><span class="cx">             return fragment;
</span><span class="cx">         }
</span><span class="cx">     } else {
</span><del>-        RefPtr&lt;Element&gt; anchor = frame.document()-&gt;createElement(HTMLNames::aTag, false);
</del><ins>+        Ref&lt;Element&gt; anchor = frame.document()-&gt;createElement(HTMLNames::aTag, false);
</ins><span class="cx">         anchor-&gt;setAttribute(HTMLNames::hrefAttr, url.string());
</span><span class="cx">         anchor-&gt;appendChild(frame.document()-&gt;createTextNode([[(NSURL *)url absoluteString] precomposedStringWithCanonicalMapping]));
</span><span class="cx"> 
</span><span class="cx">         RefPtr&lt;DocumentFragment&gt; newFragment = frame.document()-&gt;createDocumentFragment();
</span><del>-        newFragment-&gt;appendChild(anchor.release());
</del><ins>+        newFragment-&gt;appendChild(WTF::move(anchor));
</ins><span class="cx">         addFragment(newFragment);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="lines">@@ -583,7 +583,7 @@
</span><span class="cx">     if (!resource)
</span><span class="cx">         return nullptr;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; imageElement = m_frame.document()-&gt;createElement(HTMLNames::imgTag, false);
</del><ins>+    Ref&lt;Element&gt; imageElement = m_frame.document()-&gt;createElement(HTMLNames::imgTag, false);
</ins><span class="cx">     // FIXME: The code in createFragmentAndAddResources calls setDefersLoading(true). Don't we need that here?
</span><span class="cx">     if (DocumentLoader* loader = m_frame.loader().documentLoader())
</span><span class="cx">         loader-&gt;addArchiveResource(resource.get());
</span><span class="lines">@@ -592,7 +592,7 @@
</span><span class="cx">     imageElement-&gt;setAttribute(HTMLNames::srcAttr, [URL isFileURL] ? [URL absoluteString] : resource-&gt;url());
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;DocumentFragment&gt; fragment = m_frame.document()-&gt;createDocumentFragment();
</span><del>-    fragment-&gt;appendChild(imageElement.release());
</del><ins>+    fragment-&gt;appendChild(WTF::move(imageElement));
</ins><span class="cx"> 
</span><span class="cx">     return fragment.release();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingmacEditorMacmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/mac/EditorMac.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/mac/EditorMac.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/mac/EditorMac.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -527,15 +527,15 @@
</span><span class="cx">     for (size_t i = 0; i &lt; size; i++) {
</span><span class="cx">         String text = paths[i];
</span><span class="cx"> #if ENABLE(ATTACHMENT_ELEMENT)
</span><del>-        RefPtr&lt;HTMLAttachmentElement&gt; attachment = HTMLAttachmentElement::create(attachmentTag, document);
</del><ins>+        Ref&lt;HTMLAttachmentElement&gt; attachment = HTMLAttachmentElement::create(attachmentTag, document);
</ins><span class="cx">         attachment-&gt;setFile(File::create([[NSURL fileURLWithPath:text] path]).ptr());
</span><del>-        fragment-&gt;appendChild(attachment.release());
</del><ins>+        fragment-&gt;appendChild(WTF::move(attachment));
</ins><span class="cx"> #else
</span><span class="cx">         text = frame.editor().client()-&gt;userVisibleString([NSURL fileURLWithPath:text]);
</span><span class="cx"> 
</span><del>-        RefPtr&lt;HTMLElement&gt; paragraph = createDefaultParagraphElement(document);
</del><ins>+        Ref&lt;HTMLElement&gt; paragraph = createDefaultParagraphElement(document);
</ins><span class="cx">         paragraph-&gt;appendChild(document.createTextNode(text));
</span><del>-        fragment-&gt;appendChild(paragraph.release());
</del><ins>+        fragment-&gt;appendChild(WTF::move(paragraph));
</ins><span class="cx"> #endif
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -594,12 +594,12 @@
</span><span class="cx">     if (url.string().isEmpty())
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; anchor = frame.document()-&gt;createElement(HTMLNames::aTag, false);
</del><ins>+    Ref&lt;Element&gt; anchor = frame.document()-&gt;createElement(HTMLNames::aTag, false);
</ins><span class="cx">     anchor-&gt;setAttribute(HTMLNames::hrefAttr, url.string());
</span><span class="cx">     anchor-&gt;appendChild(frame.document()-&gt;createTextNode([title precomposedStringWithCanonicalMapping]));
</span><span class="cx"> 
</span><span class="cx">     fragment = frame.document()-&gt;createDocumentFragment();
</span><del>-    fragment-&gt;appendChild(anchor.release());
</del><ins>+    fragment-&gt;appendChild(WTF::move(anchor));
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -635,11 +635,11 @@
</span><span class="cx">     if (DocumentLoader* loader = m_frame.loader().documentLoader())
</span><span class="cx">         loader-&gt;addArchiveResource(resource.get());
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; imageElement = document().createElement(HTMLNames::imgTag, false);
</del><ins>+    Ref&lt;Element&gt; imageElement = document().createElement(HTMLNames::imgTag, false);
</ins><span class="cx">     imageElement-&gt;setAttribute(HTMLNames::srcAttr, resource-&gt;url().string());
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;DocumentFragment&gt; fragment = document().createDocumentFragment();
</span><del>-    fragment-&gt;appendChild(imageElement.release());
</del><ins>+    fragment-&gt;appendChild(WTF::move(imageElement));
</ins><span class="cx"> 
</span><span class="cx">     return fragment.release();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingmarkupcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/markup.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/markup.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/markup.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -704,12 +704,12 @@
</span><span class="cx">     return accumulator.serializeNodes(const_cast&lt;Node&amp;&gt;(node), childrenOnly, tagNamesToSkip);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static void fillContainerFromString(ContainerNode* paragraph, const String&amp; string)
</del><ins>+static void fillContainerFromString(ContainerNode&amp; paragraph, const String&amp; string)
</ins><span class="cx"> {
</span><del>-    Document&amp; document = paragraph-&gt;document();
</del><ins>+    Document&amp; document = paragraph.document();
</ins><span class="cx"> 
</span><span class="cx">     if (string.isEmpty()) {
</span><del>-        paragraph-&gt;appendChild(createBlockPlaceholderElement(document), ASSERT_NO_EXCEPTION);
</del><ins>+        paragraph.appendChild(createBlockPlaceholderElement(document), ASSERT_NO_EXCEPTION);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -726,11 +726,11 @@
</span><span class="cx">         // append the non-tab textual part
</span><span class="cx">         if (!s.isEmpty()) {
</span><span class="cx">             if (!tabText.isEmpty()) {
</span><del>-                paragraph-&gt;appendChild(createTabSpanElement(document, tabText), ASSERT_NO_EXCEPTION);
</del><ins>+                paragraph.appendChild(createTabSpanElement(document, tabText), ASSERT_NO_EXCEPTION);
</ins><span class="cx">                 tabText = emptyString();
</span><span class="cx">             }
</span><del>-            RefPtr&lt;Node&gt; textNode = document.createTextNode(stringWithRebalancedWhitespace(s, first, i + 1 == numEntries));
-            paragraph-&gt;appendChild(textNode.release(), ASSERT_NO_EXCEPTION);
</del><ins>+            Ref&lt;Node&gt; textNode = document.createTextNode(stringWithRebalancedWhitespace(s, first, i + 1 == numEntries));
+            paragraph.appendChild(WTF::move(textNode), ASSERT_NO_EXCEPTION);
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         // there is a tab after every entry, except the last entry
</span><span class="lines">@@ -738,7 +738,7 @@
</span><span class="cx">         if (i + 1 != numEntries)
</span><span class="cx">             tabText.append('\t');
</span><span class="cx">         else if (!tabText.isEmpty())
</span><del>-            paragraph-&gt;appendChild(createTabSpanElement(document, tabText), ASSERT_NO_EXCEPTION);
</del><ins>+            paragraph.appendChild(createTabSpanElement(document, tabText), ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">         first = false;
</span><span class="cx">     }
</span><span class="lines">@@ -778,13 +778,13 @@
</span><span class="cx">     return container-&gt;renderer()-&gt;style().preserveNewline();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;DocumentFragment&gt; createFragmentFromText(Range&amp; context, const String&amp; text)
</del><ins>+Ref&lt;DocumentFragment&gt; createFragmentFromText(Range&amp; context, const String&amp; text)
</ins><span class="cx"> {
</span><span class="cx">     Document&amp; document = context.ownerDocument();
</span><del>-    RefPtr&lt;DocumentFragment&gt; fragment = document.createDocumentFragment();
</del><ins>+    Ref&lt;DocumentFragment&gt; fragment = document.createDocumentFragment();
</ins><span class="cx">     
</span><span class="cx">     if (text.isEmpty())
</span><del>-        return fragment.release();
</del><ins>+        return fragment;
</ins><span class="cx"> 
</span><span class="cx">     String string = text;
</span><span class="cx">     string.replace(&quot;\r\n&quot;, &quot;\n&quot;);
</span><span class="lines">@@ -793,17 +793,17 @@
</span><span class="cx">     if (contextPreservesNewline(context)) {
</span><span class="cx">         fragment-&gt;appendChild(document.createTextNode(string), ASSERT_NO_EXCEPTION);
</span><span class="cx">         if (string.endsWith('\n')) {
</span><del>-            RefPtr&lt;Element&gt; element = createBreakElement(document);
</del><ins>+            Ref&lt;Element&gt; element = createBreakElement(document);
</ins><span class="cx">             element-&gt;setAttribute(classAttr, AppleInterchangeNewline);            
</span><del>-            fragment-&gt;appendChild(element.release(), ASSERT_NO_EXCEPTION);
</del><ins>+            fragment-&gt;appendChild(WTF::move(element), ASSERT_NO_EXCEPTION);
</ins><span class="cx">         }
</span><del>-        return fragment.release();
</del><ins>+        return fragment;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // A string with no newlines gets added inline, rather than being put into a paragraph.
</span><span class="cx">     if (string.find('\n') == notFound) {
</span><del>-        fillContainerFromString(fragment.get(), string);
-        return fragment.release();
</del><ins>+        fillContainerFromString(fragment, string);
+        return fragment;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Break string into paragraphs. Extra line breaks turn into empty paragraphs.
</span><span class="lines">@@ -829,17 +829,17 @@
</span><span class="cx">             element-&gt;setAttribute(classAttr, AppleInterchangeNewline);
</span><span class="cx">         } else if (useLineBreak) {
</span><span class="cx">             element = createBreakElement(document);
</span><del>-            fillContainerFromString(fragment.get(), s);
</del><ins>+            fillContainerFromString(fragment, s);
</ins><span class="cx">         } else {
</span><span class="cx">             if (useClonesOfEnclosingBlock)
</span><span class="cx">                 element = block-&gt;cloneElementWithoutChildren(document);
</span><span class="cx">             else
</span><span class="cx">                 element = createDefaultParagraphElement(document);
</span><del>-            fillContainerFromString(element.get(), s);
</del><ins>+            fillContainerFromString(*element, s);
</ins><span class="cx">         }
</span><del>-        fragment-&gt;appendChild(element.release(), ASSERT_NO_EXCEPTION);
</del><ins>+        fragment-&gt;appendChild(element.releaseNonNull(), ASSERT_NO_EXCEPTION);
</ins><span class="cx">     }
</span><del>-    return fragment.release();
</del><ins>+    return fragment;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> String documentTypeString(const Document&amp; document)
</span><span class="lines">@@ -945,10 +945,10 @@
</span><span class="cx">     RefPtr&lt;Node&gt; nextChild;
</span><span class="cx">     for (RefPtr&lt;Node&gt; child = element.firstChild(); child; child = nextChild) {
</span><span class="cx">         nextChild = child-&gt;nextSibling();
</span><del>-        element.removeChild(child.get(), ASSERT_NO_EXCEPTION);
-        fragment.insertBefore(child, &amp;element, ASSERT_NO_EXCEPTION);
</del><ins>+        element.removeChild(*child, ASSERT_NO_EXCEPTION);
+        fragment.insertBefore(*child, &amp;element, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     }
</span><del>-    fragment.removeChild(&amp;element, ASSERT_NO_EXCEPTION);
</del><ins>+    fragment.removeChild(element, ASSERT_NO_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> PassRefPtr&lt;DocumentFragment&gt; createContextualFragment(const String&amp; markup, HTMLElement* element, ParserContentPolicy parserContentPolicy, ExceptionCode&amp; ec)
</span><span class="lines">@@ -990,7 +990,7 @@
</span><span class="cx">     return hasOneChild(node) &amp;&amp; node.firstChild()-&gt;isTextNode();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void replaceChildrenWithFragment(ContainerNode&amp; container, PassRefPtr&lt;DocumentFragment&gt; fragment, ExceptionCode&amp; ec)
</del><ins>+void replaceChildrenWithFragment(ContainerNode&amp; container, Ref&lt;DocumentFragment&gt;&amp;&amp; fragment, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><span class="cx">     Ref&lt;ContainerNode&gt; containerNode(container);
</span><span class="cx">     ChildListMutationScope mutation(containerNode);
</span><span class="lines">@@ -1000,18 +1000,18 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (hasOneTextChild(containerNode) &amp;&amp; hasOneTextChild(*fragment)) {
</del><ins>+    if (hasOneTextChild(containerNode) &amp;&amp; hasOneTextChild(fragment)) {
</ins><span class="cx">         downcast&lt;Text&gt;(*containerNode-&gt;firstChild()).setData(downcast&lt;Text&gt;(*fragment-&gt;firstChild()).data(), ec);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (hasOneChild(containerNode)) {
</span><del>-        containerNode-&gt;replaceChild(fragment, containerNode-&gt;firstChild(), ec);
</del><ins>+        containerNode-&gt;replaceChild(WTF::move(fragment), *containerNode-&gt;firstChild(), ec);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     containerNode-&gt;removeChildren();
</span><del>-    containerNode-&gt;appendChild(fragment, ec);
</del><ins>+    containerNode-&gt;appendChild(WTF::move(fragment), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void replaceChildrenWithText(ContainerNode&amp; container, const String&amp; text, ExceptionCode&amp; ec)
</span><span class="lines">@@ -1027,7 +1027,7 @@
</span><span class="cx">     Ref&lt;Text&gt; textNode = Text::create(containerNode-&gt;document(), text);
</span><span class="cx"> 
</span><span class="cx">     if (hasOneChild(containerNode)) {
</span><del>-        containerNode-&gt;replaceChild(WTF::move(textNode), containerNode-&gt;firstChild(), ec);
</del><ins>+        containerNode-&gt;replaceChild(WTF::move(textNode), *containerNode-&gt;firstChild(), ec);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingmarkuph"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/markup.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/markup.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/editing/markup.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -49,7 +49,7 @@
</span><span class="cx"> enum EAbsoluteURLs { DoNotResolveURLs, ResolveAllURLs, ResolveNonLocalURLs };
</span><span class="cx"> enum EFragmentSerialization { HTMLFragmentSerialization, XMLFragmentSerialization };
</span><span class="cx"> 
</span><del>-WEBCORE_EXPORT PassRefPtr&lt;DocumentFragment&gt; createFragmentFromText(Range&amp; context, const String&amp; text);
</del><ins>+WEBCORE_EXPORT Ref&lt;DocumentFragment&gt; createFragmentFromText(Range&amp; context, const String&amp; text);
</ins><span class="cx"> WEBCORE_EXPORT Ref&lt;DocumentFragment&gt; createFragmentFromMarkup(Document&amp;, const String&amp; markup, const String&amp; baseURL, ParserContentPolicy = AllowScriptingContent);
</span><span class="cx"> PassRefPtr&lt;DocumentFragment&gt; createFragmentForInnerOuterHTML(const String&amp;, Element*, ParserContentPolicy, ExceptionCode&amp;);
</span><span class="cx"> PassRefPtr&lt;DocumentFragment&gt; createFragmentForTransformToFragment(const String&amp;, const String&amp; sourceMIMEType, Document* outputDoc);
</span><span class="lines">@@ -59,11 +59,11 @@
</span><span class="cx"> 
</span><span class="cx"> // These methods are used by HTMLElement &amp; ShadowRoot to replace the
</span><span class="cx"> // children with respected fragment/text.
</span><del>-void replaceChildrenWithFragment(ContainerNode&amp;, PassRefPtr&lt;DocumentFragment&gt;, ExceptionCode&amp;);
</del><ins>+void replaceChildrenWithFragment(ContainerNode&amp;, Ref&lt;DocumentFragment&gt;&amp;&amp;, ExceptionCode&amp;);
</ins><span class="cx"> void replaceChildrenWithText(ContainerNode&amp;, const String&amp;, ExceptionCode&amp;);
</span><span class="cx"> 
</span><del>-String createMarkup(const Range&amp;, Vector&lt;Node*&gt;* = 0, EAnnotateForInterchange = DoNotAnnotateForInterchange, bool convertBlocksToInlines = false, EAbsoluteURLs = DoNotResolveURLs);
-String createMarkup(const Node&amp;, EChildrenOnly = IncludeNode, Vector&lt;Node*&gt;* = 0, EAbsoluteURLs = DoNotResolveURLs, Vector&lt;QualifiedName&gt;* tagNamesToSkip = 0, EFragmentSerialization = HTMLFragmentSerialization);
</del><ins>+String createMarkup(const Range&amp;, Vector&lt;Node*&gt;* = nullptr, EAnnotateForInterchange = DoNotAnnotateForInterchange, bool convertBlocksToInlines = false, EAbsoluteURLs = DoNotResolveURLs);
+String createMarkup(const Node&amp;, EChildrenOnly = IncludeNode, Vector&lt;Node*&gt;* = nullptr, EAbsoluteURLs = DoNotResolveURLs, Vector&lt;QualifiedName&gt;* tagNamesToSkip = 0, EFragmentSerialization = HTMLFragmentSerialization);
</ins><span class="cx"> 
</span><span class="cx"> WEBCORE_EXPORT String createFullMarkup(const Node&amp;);
</span><span class="cx"> WEBCORE_EXPORT String createFullMarkup(const Range&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlBaseChooserOnlyDateAndTimeInputTypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -60,9 +60,9 @@
</span><span class="cx"> {
</span><span class="cx">     DEPRECATED_DEFINE_STATIC_LOCAL(AtomicString, valueContainerPseudo, (&quot;-webkit-date-and-time-value&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx"> 
</span><del>-    RefPtr&lt;HTMLDivElement&gt; valueContainer = HTMLDivElement::create(element().document());
</del><ins>+    Ref&lt;HTMLDivElement&gt; valueContainer = HTMLDivElement::create(element().document());
</ins><span class="cx">     valueContainer-&gt;setPseudo(valueContainerPseudo);
</span><del>-    element().userAgentShadowRoot()-&gt;appendChild(valueContainer.get());
</del><ins>+    element().userAgentShadowRoot()-&gt;appendChild(WTF::move(valueContainer));
</ins><span class="cx">     updateAppearance();
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlColorInputTypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/ColorInputType.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/ColorInputType.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/ColorInputType.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -107,12 +107,12 @@
</span><span class="cx">     ASSERT(element().shadowRoot());
</span><span class="cx"> 
</span><span class="cx">     Document&amp; document = element().document();
</span><del>-    RefPtr&lt;HTMLDivElement&gt; wrapperElement = HTMLDivElement::create(document);
</del><ins>+    Ref&lt;HTMLDivElement&gt; wrapperElement = HTMLDivElement::create(document);
</ins><span class="cx">     wrapperElement-&gt;setPseudo(AtomicString(&quot;-webkit-color-swatch-wrapper&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    RefPtr&lt;HTMLDivElement&gt; colorSwatch = HTMLDivElement::create(document);
</del><ins>+    Ref&lt;HTMLDivElement&gt; colorSwatch = HTMLDivElement::create(document);
</ins><span class="cx">     colorSwatch-&gt;setPseudo(AtomicString(&quot;-webkit-color-swatch&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    wrapperElement-&gt;appendChild(colorSwatch.release(), ASSERT_NO_EXCEPTION);
-    element().userAgentShadowRoot()-&gt;appendChild(wrapperElement.release(), ASSERT_NO_EXCEPTION);
</del><ins>+    wrapperElement-&gt;appendChild(WTF::move(colorSwatch), ASSERT_NO_EXCEPTION);
+    element().userAgentShadowRoot()-&gt;appendChild(WTF::move(wrapperElement), ASSERT_NO_EXCEPTION);
</ins><span class="cx">     
</span><span class="cx">     updateColorSwatch();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlFTPDirectoryDocumentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/FTPDirectoryDocument.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/FTPDirectoryDocument.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/FTPDirectoryDocument.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -104,27 +104,27 @@
</span><span class="cx">     RefPtr&lt;Element&gt; rowElement = m_tableElement-&gt;insertRow(-1, IGNORE_EXCEPTION);
</span><span class="cx">     rowElement-&gt;setAttribute(HTMLNames::classAttr, &quot;ftpDirectoryEntryRow&quot;);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; element = document()-&gt;createElement(tdTag, false);
</del><ins>+    Ref&lt;Element&gt; element = document()-&gt;createElement(tdTag, false);
</ins><span class="cx">     element-&gt;appendChild(Text::create(*document(), String(&amp;noBreakSpace, 1)), IGNORE_EXCEPTION);
</span><span class="cx">     if (isDirectory)
</span><span class="cx">         element-&gt;setAttribute(HTMLNames::classAttr, &quot;ftpDirectoryIcon ftpDirectoryTypeDirectory&quot;);
</span><span class="cx">     else
</span><span class="cx">         element-&gt;setAttribute(HTMLNames::classAttr, &quot;ftpDirectoryIcon ftpDirectoryTypeFile&quot;);
</span><del>-    rowElement-&gt;appendChild(element, IGNORE_EXCEPTION);
</del><ins>+    rowElement-&gt;appendChild(WTF::move(element), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     element = createTDForFilename(filename);
</span><span class="cx">     element-&gt;setAttribute(HTMLNames::classAttr, &quot;ftpDirectoryFileName&quot;);
</span><del>-    rowElement-&gt;appendChild(element, IGNORE_EXCEPTION);
</del><ins>+    rowElement-&gt;appendChild(WTF::move(element), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     element = document()-&gt;createElement(tdTag, false);
</span><span class="cx">     element-&gt;appendChild(Text::create(*document(), date), IGNORE_EXCEPTION);
</span><span class="cx">     element-&gt;setAttribute(HTMLNames::classAttr, &quot;ftpDirectoryFileDate&quot;);
</span><del>-    rowElement-&gt;appendChild(element, IGNORE_EXCEPTION);
</del><ins>+    rowElement-&gt;appendChild(WTF::move(element), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     element = document()-&gt;createElement(tdTag, false);
</span><span class="cx">     element-&gt;appendChild(Text::create(*document(), size), IGNORE_EXCEPTION);
</span><span class="cx">     element-&gt;setAttribute(HTMLNames::classAttr, &quot;ftpDirectoryFileSize&quot;);
</span><del>-    rowElement-&gt;appendChild(element, IGNORE_EXCEPTION);
</del><ins>+    rowElement-&gt;appendChild(WTF::move(element), IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;Element&gt; FTPDirectoryDocumentParser::createTDForFilename(const String&amp; filename)
</span><span class="lines">@@ -135,12 +135,12 @@
</span><span class="cx">     else
</span><span class="cx">         fullURL = fullURL + '/' + filename;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; anchorElement = document()-&gt;createElement(aTag, false);
</del><ins>+    Ref&lt;Element&gt; anchorElement = document()-&gt;createElement(aTag, false);
</ins><span class="cx">     anchorElement-&gt;setAttribute(HTMLNames::hrefAttr, fullURL);
</span><span class="cx">     anchorElement-&gt;appendChild(Text::create(*document(), filename), IGNORE_EXCEPTION);
</span><span class="cx"> 
</span><span class="cx">     Ref&lt;Element&gt; tdElement = document()-&gt;createElement(tdTag, false);
</span><del>-    tdElement-&gt;appendChild(anchorElement, IGNORE_EXCEPTION);
</del><ins>+    tdElement-&gt;appendChild(WTF::move(anchorElement), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     return tdElement;
</span><span class="cx"> }
</span><span class="lines">@@ -312,9 +312,9 @@
</span><span class="cx">     // If that fails for some reason, cram it on the end of the document as a last
</span><span class="cx">     // ditch effort
</span><span class="cx">     if (auto* body = document()-&gt;bodyOrFrameset())
</span><del>-        body-&gt;appendChild(m_tableElement, IGNORE_EXCEPTION);
</del><ins>+        body-&gt;appendChild(*m_tableElement, IGNORE_EXCEPTION);
</ins><span class="cx">     else
</span><del>-        document()-&gt;appendChild(m_tableElement, IGNORE_EXCEPTION);
</del><ins>+        document()-&gt;appendChild(*m_tableElement, IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="lines">@@ -325,16 +325,16 @@
</span><span class="cx"> 
</span><span class="cx">     // FIXME: Make this &quot;basic document&quot; more acceptable
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; bodyElement = document()-&gt;createElement(bodyTag, false);
</del><ins>+    Ref&lt;Element&gt; bodyElement = document()-&gt;createElement(bodyTag, false);
</ins><span class="cx"> 
</span><del>-    document()-&gt;appendChild(bodyElement, IGNORE_EXCEPTION);
</del><ins>+    document()-&gt;appendChild(bodyElement.copyRef(), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; tableElement = document()-&gt;createElement(tableTag, false);
-    m_tableElement = downcast&lt;HTMLTableElement&gt;(tableElement.get());
</del><ins>+    Ref&lt;Element&gt; tableElement = document()-&gt;createElement(tableTag, false);
+    m_tableElement = downcast&lt;HTMLTableElement&gt;(tableElement.ptr());
</ins><span class="cx">     m_tableElement-&gt;setAttribute(HTMLNames::idAttr, &quot;ftpDirectoryTable&quot;);
</span><span class="cx">     m_tableElement-&gt;setAttribute(HTMLNames::styleAttr, &quot;width:100%&quot;);
</span><span class="cx"> 
</span><del>-    bodyElement-&gt;appendChild(m_tableElement, IGNORE_EXCEPTION);
</del><ins>+    bodyElement-&gt;appendChild(WTF::move(tableElement), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     document()-&gt;processViewport(&quot;width=device-width&quot;, ViewportArguments::ViewportMeta);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLDetailsElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLDetailsElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLDetailsElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLDetailsElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -90,11 +90,11 @@
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;DetailsSummaryElement&gt; DetailsSummaryElement::create(Document&amp; document)
</span><span class="cx"> {
</span><del>-    RefPtr&lt;HTMLSummaryElement&gt; summary = HTMLSummaryElement::create(summaryTag, document);
</del><ins>+    Ref&lt;HTMLSummaryElement&gt; summary = HTMLSummaryElement::create(summaryTag, document);
</ins><span class="cx">     summary-&gt;appendChild(Text::create(document, defaultDetailsSummaryText()), ASSERT_NO_EXCEPTION);
</span><span class="cx"> 
</span><span class="cx">     Ref&lt;DetailsSummaryElement&gt; detailsSummary = adoptRef(*new DetailsSummaryElement(document));
</span><del>-    detailsSummary-&gt;appendChild(summary);
</del><ins>+    detailsSummary-&gt;appendChild(WTF::move(summary));
</ins><span class="cx">     return detailsSummary;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -584,9 +584,9 @@
</span><span class="cx"> 
</span><span class="cx">     // Add text nodes and &lt;br&gt; elements.
</span><span class="cx">     ec = 0;
</span><del>-    RefPtr&lt;DocumentFragment&gt; fragment = textToFragment(text, ec);
</del><ins>+    Ref&lt;DocumentFragment&gt; fragment = textToFragment(text, ec);
</ins><span class="cx">     if (!ec)
</span><del>-        replaceChildrenWithFragment(*this, fragment.release(), ec);
</del><ins>+        replaceChildrenWithFragment(*this, WTF::move(fragment), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLElement::setOuterText(const String&amp; text, ExceptionCode&amp; ec)
</span><span class="lines">@@ -621,7 +621,7 @@
</span><span class="cx">         ec = HIERARCHY_REQUEST_ERR;
</span><span class="cx">     if (ec)
</span><span class="cx">         return;
</span><del>-    parent-&gt;replaceChild(newChild.release(), this, ec);
</del><ins>+    parent-&gt;replaceChild(newChild.releaseNonNull(), *this, ec);
</ins><span class="cx"> 
</span><span class="cx">     RefPtr&lt;Node&gt; node = next ? next-&gt;previousSibling() : nullptr;
</span><span class="cx">     if (!ec &amp;&amp; is&lt;Text&gt;(node.get()))
</span><span class="lines">@@ -630,7 +630,7 @@
</span><span class="cx">         mergeWithNextTextNode(downcast&lt;Text&gt;(*prev), ec);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-Node* HTMLElement::insertAdjacent(const String&amp; where, Node* newChild, ExceptionCode&amp; ec)
</del><ins>+Node* HTMLElement::insertAdjacent(const String&amp; where, Ref&lt;Node&gt;&amp;&amp; newChild, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><span class="cx">     // In Internet Explorer if the element has no parent and where is &quot;beforeBegin&quot; or &quot;afterEnd&quot;,
</span><span class="cx">     // a document fragment is created and the elements appended in the correct order. This document
</span><span class="lines">@@ -641,18 +641,18 @@
</span><span class="cx"> 
</span><span class="cx">     if (equalIgnoringCase(where, &quot;beforeBegin&quot;)) {
</span><span class="cx">         ContainerNode* parent = this-&gt;parentNode();
</span><del>-        return (parent &amp;&amp; parent-&gt;insertBefore(newChild, this, ec)) ? newChild : nullptr;
</del><ins>+        return (parent &amp;&amp; parent-&gt;insertBefore(newChild.copyRef(), this, ec)) ? newChild.ptr() : nullptr;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (equalIgnoringCase(where, &quot;afterBegin&quot;))
</span><del>-        return insertBefore(newChild, firstChild(), ec) ? newChild : nullptr;
</del><ins>+        return insertBefore(newChild.copyRef(), firstChild(), ec) ? newChild.ptr() : nullptr;
</ins><span class="cx"> 
</span><span class="cx">     if (equalIgnoringCase(where, &quot;beforeEnd&quot;))
</span><del>-        return appendChild(newChild, ec) ? newChild : nullptr;
</del><ins>+        return appendChild(newChild.copyRef(), ec) ? newChild.ptr() : nullptr;
</ins><span class="cx"> 
</span><span class="cx">     if (equalIgnoringCase(where, &quot;afterEnd&quot;)) {
</span><span class="cx">         ContainerNode* parent = this-&gt;parentNode();
</span><del>-        return (parent &amp;&amp; parent-&gt;insertBefore(newChild, nextSibling(), ec)) ? newChild : nullptr;
</del><ins>+        return (parent &amp;&amp; parent-&gt;insertBefore(newChild.copyRef(), nextSibling(), ec)) ? newChild.ptr() : nullptr;
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     // IE throws COM Exception E_INVALIDARG; this is the best DOM exception alternative.
</span><span class="lines">@@ -668,7 +668,7 @@
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    Node* returnValue = insertAdjacent(where, newChild, ec);
</del><ins>+    Node* returnValue = insertAdjacent(where, *newChild, ec);
</ins><span class="cx">     ASSERT_WITH_SECURITY_IMPLICATION(!returnValue || is&lt;Element&gt;(*returnValue));
</span><span class="cx">     return downcast&lt;Element&gt;(returnValue); 
</span><span class="cx"> }
</span><span class="lines">@@ -699,13 +699,12 @@
</span><span class="cx">     RefPtr&lt;DocumentFragment&gt; fragment = createFragmentForInnerOuterHTML(markup, contextElement, AllowScriptingContent, ec);
</span><span class="cx">     if (!fragment)
</span><span class="cx">         return;
</span><del>-    insertAdjacent(where, fragment.get(), ec);
</del><ins>+    insertAdjacent(where, fragment.releaseNonNull(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLElement::insertAdjacentText(const String&amp; where, const String&amp; text, ExceptionCode&amp; ec)
</span><span class="cx"> {
</span><del>-    RefPtr&lt;Text&gt; textNode = document().createTextNode(text);
-    insertAdjacent(where, textNode.get(), ec);
</del><ins>+    insertAdjacent(where, document().createTextNode(text), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLElement::applyAlignmentAttributeToStyle(const AtomicString&amp; alignment, MutableStyleProperties&amp; style)
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLElement.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLElement.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLElement.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -130,7 +130,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual HTMLFormElement* virtualForm() const;
</span><span class="cx"> 
</span><del>-    Node* insertAdjacent(const String&amp; where, Node* newChild, ExceptionCode&amp;);
</del><ins>+    Node* insertAdjacent(const String&amp; where, Ref&lt;Node&gt;&amp;&amp; newChild, ExceptionCode&amp;);
</ins><span class="cx">     Ref&lt;DocumentFragment&gt; textToFragment(const String&amp;, ExceptionCode&amp;);
</span><span class="cx"> 
</span><span class="cx">     void dirAttributeChanged(const AtomicString&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLImageElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLImageElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLImageElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLImageElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -504,7 +504,7 @@
</span><span class="cx">     if (!imageControls)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    ensureUserAgentShadowRoot().appendChild(imageControls);
</del><ins>+    ensureUserAgentShadowRoot().appendChild(imageControls.releaseNonNull());
</ins><span class="cx"> 
</span><span class="cx">     auto* renderObject = renderer();
</span><span class="cx">     if (!renderObject)
</span><span class="lines">@@ -521,7 +521,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (Node* node = shadowRoot-&gt;firstChild()) {
</span><span class="cx">         ASSERT_WITH_SECURITY_IMPLICATION(node-&gt;isImageControlsRootElement());
</span><del>-        shadowRoot-&gt;removeChild(node);
</del><ins>+        shadowRoot-&gt;removeChild(*node);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     auto* renderObject = renderer();
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLKeygenElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLKeygenElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLKeygenElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLKeygenElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -58,7 +58,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    virtual RefPtr&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument) override
</del><ins>+    virtual Ref&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument) override
</ins><span class="cx">     {
</span><span class="cx">         return create(targetDocument);
</span><span class="cx">     }
</span><span class="lines">@@ -73,14 +73,14 @@
</span><span class="cx">     Vector&lt;String&gt; keys;
</span><span class="cx">     getSupportedKeySizes(keys);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;HTMLSelectElement&gt; select = KeygenSelectElement::create(document);
</del><ins>+    Ref&lt;HTMLSelectElement&gt; select = KeygenSelectElement::create(document);
</ins><span class="cx">     for (size_t i = 0; i &lt; keys.size(); ++i) {
</span><del>-        RefPtr&lt;HTMLOptionElement&gt; option = HTMLOptionElement::create(document);
-        select-&gt;appendChild(option, IGNORE_EXCEPTION);
</del><ins>+        Ref&lt;HTMLOptionElement&gt; option = HTMLOptionElement::create(document);
+        select-&gt;appendChild(option.copyRef(), IGNORE_EXCEPTION);
</ins><span class="cx">         option-&gt;appendChild(Text::create(document, keys[i]), IGNORE_EXCEPTION);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    ensureUserAgentShadowRoot().appendChild(select, IGNORE_EXCEPTION);
</del><ins>+    ensureUserAgentShadowRoot().appendChild(WTF::move(select), IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;HTMLKeygenElement&gt; HTMLKeygenElement::create(const QualifiedName&amp; tagName, Document&amp; document, HTMLFormElement* form)
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMeterElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMeterElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMeterElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLMeterElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -229,16 +229,16 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!m_value);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;MeterInnerElement&gt; inner = MeterInnerElement::create(document());
-    root-&gt;appendChild(inner);
</del><ins>+    Ref&lt;MeterInnerElement&gt; inner = MeterInnerElement::create(document());
+    root-&gt;appendChild(inner.copyRef());
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;MeterBarElement&gt; bar = MeterBarElement::create(document());
</del><ins>+    Ref&lt;MeterBarElement&gt; bar = MeterBarElement::create(document());
</ins><span class="cx">     m_value = MeterValueElement::create(document());
</span><span class="cx">     m_value-&gt;setWidthPercentage(0);
</span><span class="cx">     m_value-&gt;updatePseudo();
</span><del>-    bar-&gt;appendChild(m_value, ASSERT_NO_EXCEPTION);
</del><ins>+    bar-&gt;appendChild(*m_value, ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    inner-&gt;appendChild(bar, ASSERT_NO_EXCEPTION);
</del><ins>+    inner-&gt;appendChild(WTF::move(bar), ASSERT_NO_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLOptionElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLOptionElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLOptionElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLOptionElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -71,12 +71,12 @@
</span><span class="cx"> {
</span><span class="cx">     RefPtr&lt;HTMLOptionElement&gt; element = adoptRef(new HTMLOptionElement(optionTag, document));
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Text&gt; text = Text::create(document, data.isNull() ? &quot;&quot; : data);
</del><ins>+    Ref&lt;Text&gt; text = Text::create(document, data.isNull() ? &quot;&quot; : data);
</ins><span class="cx"> 
</span><span class="cx">     ec = 0;
</span><del>-    element-&gt;appendChild(text.release(), ec);
</del><ins>+    element-&gt;appendChild(WTF::move(text), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     if (!value.isNull())
</span><span class="cx">         element-&gt;setValue(value);
</span><span class="lines">@@ -84,7 +84,7 @@
</span><span class="cx">         element-&gt;setAttribute(selectedAttr, emptyAtom);
</span><span class="cx">     element-&gt;setSelected(selected);
</span><span class="cx"> 
</span><del>-    return element.release();
</del><ins>+    return element;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool HTMLOptionElement::isFocusable() const
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLProgressElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLProgressElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLProgressElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLProgressElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -149,16 +149,16 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!m_value);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;ProgressInnerElement&gt; inner = ProgressInnerElement::create(document());
-    root-&gt;appendChild(inner);
</del><ins>+    Ref&lt;ProgressInnerElement&gt; inner = ProgressInnerElement::create(document());
+    root-&gt;appendChild(inner.copyRef());
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;ProgressBarElement&gt; bar = ProgressBarElement::create(document());
-    RefPtr&lt;ProgressValueElement&gt; value = ProgressValueElement::create(document());
-    m_value = value.get();
</del><ins>+    Ref&lt;ProgressBarElement&gt; bar = ProgressBarElement::create(document());
+    Ref&lt;ProgressValueElement&gt; value = ProgressValueElement::create(document());
+    m_value = value.ptr();
</ins><span class="cx">     m_value-&gt;setWidthPercentage(HTMLProgressElement::IndeterminatePosition * 100);
</span><del>-    bar-&gt;appendChild(m_value, ASSERT_NO_EXCEPTION);
</del><ins>+    bar-&gt;appendChild(*m_value, ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    inner-&gt;appendChild(bar, ASSERT_NO_EXCEPTION);
</del><ins>+    inner-&gt;appendChild(WTF::move(bar), ASSERT_NO_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool HTMLProgressElement::shouldAppearIndeterminate() const
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLScriptElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLScriptElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLScriptElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLScriptElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -169,9 +169,9 @@
</span><span class="cx">     dispatchEvent(Event::create(eventNames().loadEvent, false, false));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Element&gt; HTMLScriptElement::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</del><ins>+Ref&lt;Element&gt; HTMLScriptElement::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</ins><span class="cx"> {
</span><del>-    return adoptRef(new HTMLScriptElement(tagQName(), targetDocument, false, alreadyStarted()));
</del><ins>+    return adoptRef(*new HTMLScriptElement(tagQName(), targetDocument, false, alreadyStarted()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLScriptElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLScriptElement.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLScriptElement.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLScriptElement.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual void dispatchLoadEvent() override;
</span><span class="cx"> 
</span><del>-    virtual RefPtr&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;) override;
</del><ins>+    virtual Ref&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;) override;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } //namespace
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLSelectElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLSelectElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLSelectElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLSelectElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -227,7 +227,7 @@
</span><span class="cx">     // Make sure the element is ref'd and deref'd so we don't leak it.
</span><span class="cx">     Ref&lt;HTMLElement&gt; protectNewChild(*element);
</span><span class="cx"> 
</span><del>-    insertBefore(element, beforeElement, ec);
</del><ins>+    insertBefore(*element, beforeElement, ec);
</ins><span class="cx">     updateValidity();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -486,12 +486,12 @@
</span><span class="cx"> 
</span><span class="cx">         // Removing children fires mutation events, which might mutate the DOM further, so we first copy out a list
</span><span class="cx">         // of elements that we intend to remove then attempt to remove them one at a time.
</span><del>-        Vector&lt;RefPtr&lt;Element&gt;&gt; itemsToRemove;
</del><ins>+        Vector&lt;Ref&lt;Element&gt;&gt; itemsToRemove;
</ins><span class="cx">         size_t optionIndex = 0;
</span><span class="cx">         for (auto&amp; item : items) {
</span><span class="cx">             if (is&lt;HTMLOptionElement&gt;(*item) &amp;&amp; optionIndex++ &gt;= newLen) {
</span><span class="cx">                 ASSERT(item-&gt;parentNode());
</span><del>-                itemsToRemove.append(item);
</del><ins>+                itemsToRemove.append(*item);
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTableElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTableElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTableElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLTableElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -81,7 +81,7 @@
</span><span class="cx"> {
</span><span class="cx">     deleteCaption();
</span><span class="cx">     if (newCaption)
</span><del>-        insertBefore(newCaption, firstChild(), ec);
</del><ins>+        insertBefore(*newCaption, firstChild(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> HTMLTableSectionElement* HTMLTableElement::tHead() const
</span><span class="lines">@@ -110,7 +110,7 @@
</span><span class="cx">         if (child-&gt;isElementNode() &amp;&amp; !child-&gt;hasTagName(captionTag) &amp;&amp; !child-&gt;hasTagName(colgroupTag))
</span><span class="cx">             break;
</span><span class="cx"> 
</span><del>-    insertBefore(newHead, child, ec);
</del><ins>+    insertBefore(*newHead, child, ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> HTMLTableSectionElement* HTMLTableElement::tFoot() const
</span><span class="lines">@@ -139,57 +139,60 @@
</span><span class="cx">         if (child-&gt;isElementNode() &amp;&amp; !child-&gt;hasTagName(captionTag) &amp;&amp; !child-&gt;hasTagName(colgroupTag) &amp;&amp; !child-&gt;hasTagName(theadTag))
</span><span class="cx">             break;
</span><span class="cx"> 
</span><del>-    insertBefore(newFoot, child, ec);
</del><ins>+    insertBefore(*newFoot, child, ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;HTMLElement&gt; HTMLTableElement::createTHead()
</del><ins>+Ref&lt;HTMLTableSectionElement&gt; HTMLTableElement::createTHead()
</ins><span class="cx"> {
</span><span class="cx">     if (HTMLTableSectionElement* existingHead = tHead())
</span><del>-        return existingHead;
-    RefPtr&lt;HTMLTableSectionElement&gt; head = HTMLTableSectionElement::create(theadTag, document());
-    setTHead(head, IGNORE_EXCEPTION);
</del><ins>+        return *existingHead;
+    Ref&lt;HTMLTableSectionElement&gt; head = HTMLTableSectionElement::create(theadTag, document());
+    setTHead(head.ptr(), IGNORE_EXCEPTION);
</ins><span class="cx">     return head;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTableElement::deleteTHead()
</span><span class="cx"> {
</span><del>-    removeChild(tHead(), IGNORE_EXCEPTION);
</del><ins>+    if (auto* tHead = this-&gt;tHead())
+        removeChild(*tHead, IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;HTMLElement&gt; HTMLTableElement::createTFoot()
</del><ins>+Ref&lt;HTMLTableSectionElement&gt; HTMLTableElement::createTFoot()
</ins><span class="cx"> {
</span><span class="cx">     if (HTMLTableSectionElement* existingFoot = tFoot())
</span><del>-        return existingFoot;
-    RefPtr&lt;HTMLTableSectionElement&gt; foot = HTMLTableSectionElement::create(tfootTag, document());
-    setTFoot(foot, IGNORE_EXCEPTION);
</del><ins>+        return *existingFoot;
+    Ref&lt;HTMLTableSectionElement&gt; foot = HTMLTableSectionElement::create(tfootTag, document());
+    setTFoot(foot.ptr(), IGNORE_EXCEPTION);
</ins><span class="cx">     return foot;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTableElement::deleteTFoot()
</span><span class="cx"> {
</span><del>-    removeChild(tFoot(), IGNORE_EXCEPTION);
</del><ins>+    if (auto* tFoot = this-&gt;tFoot())
+        removeChild(*tFoot, IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;HTMLElement&gt; HTMLTableElement::createTBody()
</del><ins>+Ref&lt;HTMLTableSectionElement&gt; HTMLTableElement::createTBody()
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;HTMLTableSectionElement&gt; body = HTMLTableSectionElement::create(tbodyTag, document());
-    Node* referenceElement = lastBody() ? lastBody()-&gt;nextSibling() : 0;
-    insertBefore(body, referenceElement, ASSERT_NO_EXCEPTION);
</del><ins>+    Ref&lt;HTMLTableSectionElement&gt; body = HTMLTableSectionElement::create(tbodyTag, document());
+    Node* referenceElement = lastBody() ? lastBody()-&gt;nextSibling() : nullptr;
+    insertBefore(body.copyRef(), referenceElement, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     return body;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;HTMLElement&gt; HTMLTableElement::createCaption()
</del><ins>+Ref&lt;HTMLTableCaptionElement&gt; HTMLTableElement::createCaption()
</ins><span class="cx"> {
</span><span class="cx">     if (HTMLTableCaptionElement* existingCaption = caption())
</span><del>-        return existingCaption;
-    RefPtr&lt;HTMLTableCaptionElement&gt; caption = HTMLTableCaptionElement::create(captionTag, document());
-    setCaption(caption, IGNORE_EXCEPTION);
</del><ins>+        return *existingCaption;
+    Ref&lt;HTMLTableCaptionElement&gt; caption = HTMLTableCaptionElement::create(captionTag, document());
+    setCaption(caption.ptr(), IGNORE_EXCEPTION);
</ins><span class="cx">     return caption;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTableElement::deleteCaption()
</span><span class="cx"> {
</span><del>-    removeChild(caption(), IGNORE_EXCEPTION);
</del><ins>+    if (auto* caption = this-&gt;caption())
+        removeChild(*caption, IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> HTMLTableSectionElement* HTMLTableElement::lastBody() const
</span><span class="lines">@@ -234,22 +237,22 @@
</span><span class="cx">     else {
</span><span class="cx">         parent = lastBody();
</span><span class="cx">         if (!parent) {
</span><del>-            RefPtr&lt;HTMLTableSectionElement&gt; newBody = HTMLTableSectionElement::create(tbodyTag, document());
-            RefPtr&lt;HTMLTableRowElement&gt; newRow = HTMLTableRowElement::create(document());
-            newBody-&gt;appendChild(newRow, ec);
-            appendChild(newBody.release(), ec);
-            return newRow;
</del><ins>+            Ref&lt;HTMLTableSectionElement&gt; newBody = HTMLTableSectionElement::create(tbodyTag, document());
+            Ref&lt;HTMLTableRowElement&gt; newRow = HTMLTableRowElement::create(document());
+            newBody-&gt;appendChild(newRow.copyRef(), ec);
+            appendChild(WTF::move(newBody), ec);
+            return WTF::move(newRow);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    RefPtr&lt;HTMLTableRowElement&gt; newRow = HTMLTableRowElement::create(document());
-    parent-&gt;insertBefore(newRow, row.get(), ec);
-    return newRow;
</del><ins>+    Ref&lt;HTMLTableRowElement&gt; newRow = HTMLTableRowElement::create(document());
+    parent-&gt;insertBefore(newRow.copyRef(), row.get(), ec);
+    return WTF::move(newRow);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTableElement::deleteRow(int index, ExceptionCode&amp; ec)
</span><span class="cx"> {
</span><del>-    HTMLTableRowElement* row = 0;
</del><ins>+    HTMLTableRowElement* row = nullptr;
</ins><span class="cx">     if (index == -1)
</span><span class="cx">         row = HTMLTableRowsCollection::lastRow(*this);
</span><span class="cx">     else {
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTableElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTableElement.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTableElement.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLTableElement.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -49,12 +49,12 @@
</span><span class="cx">     HTMLTableSectionElement* tFoot() const;
</span><span class="cx">     void setTFoot(PassRefPtr&lt;HTMLTableSectionElement&gt;, ExceptionCode&amp;);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;HTMLElement&gt; createTHead();
</del><ins>+    Ref&lt;HTMLTableSectionElement&gt; createTHead();
</ins><span class="cx">     void deleteTHead();
</span><del>-    RefPtr&lt;HTMLElement&gt; createTFoot();
</del><ins>+    Ref&lt;HTMLTableSectionElement&gt; createTFoot();
</ins><span class="cx">     void deleteTFoot();
</span><del>-    RefPtr&lt;HTMLElement&gt; createTBody();
-    RefPtr&lt;HTMLElement&gt; createCaption();
</del><ins>+    Ref&lt;HTMLTableSectionElement&gt; createTBody();
+    Ref&lt;HTMLTableCaptionElement&gt; createCaption();
</ins><span class="cx">     void deleteCaption();
</span><span class="cx">     RefPtr&lt;HTMLElement&gt; insertRow(ExceptionCode&amp; ec) { return insertRow(-1, ec); }
</span><span class="cx">     RefPtr&lt;HTMLElement&gt; insertRow(int index, ExceptionCode&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTableRowElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTableRowElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTableRowElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLTableRowElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -28,7 +28,6 @@
</span><span class="cx"> #include &quot;ExceptionCode.h&quot;
</span><span class="cx"> #include &quot;GenericCachedHTMLCollection.h&quot;
</span><span class="cx"> #include &quot;HTMLNames.h&quot;
</span><del>-#include &quot;HTMLTableCellElement.h&quot;
</del><span class="cx"> #include &quot;HTMLTableElement.h&quot;
</span><span class="cx"> #include &quot;HTMLTableSectionElement.h&quot;
</span><span class="cx"> #include &quot;NodeList.h&quot;
</span><span class="lines">@@ -119,27 +118,27 @@
</span><span class="cx">     return rIndex;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;HTMLElement&gt; HTMLTableRowElement::insertCell(int index, ExceptionCode&amp; ec)
</del><ins>+RefPtr&lt;HTMLTableCellElement&gt; HTMLTableRowElement::insertCell(int index, ExceptionCode&amp; ec)
</ins><span class="cx"> {
</span><span class="cx">     Ref&lt;HTMLCollection&gt; children = cells();
</span><span class="cx">     int numCells = children-&gt;length();
</span><span class="cx">     if (index &lt; -1 || index &gt; numCells) {
</span><span class="cx">         ec = INDEX_SIZE_ERR;
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    RefPtr&lt;HTMLTableCellElement&gt; cell = HTMLTableCellElement::create(tdTag, document());
</del><ins>+    Ref&lt;HTMLTableCellElement&gt; cell = HTMLTableCellElement::create(tdTag, document());
</ins><span class="cx">     if (index &lt; 0 || index &gt;= numCells)
</span><del>-        appendChild(cell, ec);
</del><ins>+        appendChild(cell.copyRef(), ec);
</ins><span class="cx">     else {
</span><span class="cx">         Node* n;
</span><span class="cx">         if (index &lt; 1)
</span><span class="cx">             n = firstChild();
</span><span class="cx">         else
</span><span class="cx">             n = children-&gt;item(index);
</span><del>-        insertBefore(cell, n, ec);
</del><ins>+        insertBefore(cell.copyRef(), n, ec);
</ins><span class="cx">     }
</span><del>-    return cell;
</del><ins>+    return WTF::move(cell);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTableRowElement::deleteCell(int index, ExceptionCode&amp; ec)
</span><span class="lines">@@ -150,7 +149,7 @@
</span><span class="cx">         index = numCells-1;
</span><span class="cx">     if (index &gt;= 0 &amp;&amp; index &lt; numCells) {
</span><span class="cx">         RefPtr&lt;Node&gt; cell = children-&gt;item(index);
</span><del>-        HTMLElement::removeChild(cell.get(), ec);
</del><ins>+        HTMLElement::removeChild(*cell, ec);
</ins><span class="cx">     } else
</span><span class="cx">         ec = INDEX_SIZE_ERR;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTableRowElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTableRowElement.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTableRowElement.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLTableRowElement.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -26,6 +26,7 @@
</span><span class="cx"> #ifndef HTMLTableRowElement_h
</span><span class="cx"> #define HTMLTableRowElement_h
</span><span class="cx"> 
</span><ins>+#include &quot;HTMLTableCellElement.h&quot;
</ins><span class="cx"> #include &quot;HTMLTablePartElement.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="lines">@@ -41,8 +42,8 @@
</span><span class="cx">     int sectionRowIndex() const;
</span><span class="cx">     void setSectionRowIndex(int);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;HTMLElement&gt; insertCell(ExceptionCode&amp; ec) { return insertCell(-1, ec); }
-    RefPtr&lt;HTMLElement&gt; insertCell(int index, ExceptionCode&amp;);
</del><ins>+    RefPtr&lt;HTMLTableCellElement&gt; insertCell(ExceptionCode&amp; ec) { return insertCell(-1, ec); }
+    RefPtr&lt;HTMLTableCellElement&gt; insertCell(int index, ExceptionCode&amp;);
</ins><span class="cx">     void deleteCell(int index, ExceptionCode&amp;);
</span><span class="cx"> 
</span><span class="cx">     Ref&lt;HTMLCollection&gt; cells();
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTableSectionElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTableSectionElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTableSectionElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLTableSectionElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -68,14 +68,14 @@
</span><span class="cx">     else {
</span><span class="cx">         row = HTMLTableRowElement::create(trTag, document());
</span><span class="cx">         if (numRows == index || index == -1)
</span><del>-            appendChild(row, ec);
</del><ins>+            appendChild(*row, ec);
</ins><span class="cx">         else {
</span><span class="cx">             Node* n;
</span><span class="cx">             if (index &lt; 1)
</span><span class="cx">                 n = firstChild();
</span><span class="cx">             else
</span><span class="cx">                 n = children-&gt;item(index);
</span><del>-            insertBefore(row, n, ec);
</del><ins>+            insertBefore(*row, n, ec);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx">     return row;
</span><span class="lines">@@ -89,7 +89,7 @@
</span><span class="cx">         index = numRows - 1;
</span><span class="cx">     if (index &gt;= 0 &amp;&amp; index &lt; numRows) {
</span><span class="cx">         RefPtr&lt;Node&gt; row = children-&gt;item(index);
</span><del>-        HTMLElement::removeChild(row.get(), ec);
</del><ins>+        HTMLElement::removeChild(*row, ec);
</ins><span class="cx">     } else
</span><span class="cx">         ec = INDEX_SIZE_ERR;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTemplateElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTemplateElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTemplateElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLTemplateElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx">     return m_content.get();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Node&gt; HTMLTemplateElement::cloneNodeInternal(Document&amp; targetDocument, CloningOperation type)
</del><ins>+Ref&lt;Node&gt; HTMLTemplateElement::cloneNodeInternal(Document&amp; targetDocument, CloningOperation type)
</ins><span class="cx"> {
</span><span class="cx">     RefPtr&lt;Node&gt; clone;
</span><span class="cx">     switch (type) {
</span><span class="lines">@@ -82,8 +82,8 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     if (m_content)
</span><del>-        content()-&gt;cloneChildNodes(downcast&lt;HTMLTemplateElement&gt;(clone.get())-&gt;content());
-    return clone.release();
</del><ins>+        content()-&gt;cloneChildNodes(*downcast&lt;HTMLTemplateElement&gt;(clone.get())-&gt;content());
+    return clone.releaseNonNull();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTemplateElement::didMoveToNewDocument(Document* oldDocument)
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTemplateElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTemplateElement.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTemplateElement.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLTemplateElement.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx"> private:
</span><span class="cx">     HTMLTemplateElement(const QualifiedName&amp;, Document&amp;);
</span><span class="cx"> 
</span><del>-    virtual RefPtr&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</del><ins>+    virtual Ref&lt;Node&gt; cloneNodeInternal(Document&amp;, CloningOperation) override;
</ins><span class="cx">     virtual void didMoveToNewDocument(Document* oldDocument) override;
</span><span class="cx"> 
</span><span class="cx">     mutable RefPtr&lt;TemplateContentDocumentFragment&gt; m_content;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTextAreaElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTextAreaElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTextAreaElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/HTMLTextAreaElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -406,9 +406,9 @@
</span><span class="cx">     Ref&lt;HTMLTextAreaElement&gt; protectFromMutationEvents(*this);
</span><span class="cx"> 
</span><span class="cx">     // To preserve comments, remove only the text nodes, then add a single text node.
</span><del>-    Vector&lt;RefPtr&lt;Text&gt;&gt; textNodes;
</del><ins>+    Vector&lt;Ref&lt;Text&gt;&gt; textNodes;
</ins><span class="cx">     for (Text* textNode = TextNodeTraversal::firstChild(*this); textNode; textNode = TextNodeTraversal::nextSibling(*textNode))
</span><del>-        textNodes.append(textNode);
</del><ins>+        textNodes.append(*textNode);
</ins><span class="cx"> 
</span><span class="cx">     size_t size = textNodes.size();
</span><span class="cx">     for (size_t i = 0; i &lt; size; ++i)
</span><span class="lines">@@ -523,8 +523,8 @@
</span><span class="cx">     String placeholderText = strippedPlaceholder();
</span><span class="cx">     if (placeholderText.isEmpty()) {
</span><span class="cx">         if (m_placeholder) {
</span><del>-            userAgentShadowRoot()-&gt;removeChild(m_placeholder, ASSERT_NO_EXCEPTION);
-            m_placeholder = 0;
</del><ins>+            userAgentShadowRoot()-&gt;removeChild(*m_placeholder, ASSERT_NO_EXCEPTION);
+            m_placeholder = nullptr;
</ins><span class="cx">         }
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -533,7 +533,7 @@
</span><span class="cx">         m_placeholder = placeholder.get();
</span><span class="cx">         m_placeholder-&gt;setPseudo(AtomicString(&quot;-webkit-input-placeholder&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx">         m_placeholder-&gt;setInlineStyleProperty(CSSPropertyDisplay, isPlaceholderVisible() ? CSSValueBlock : CSSValueNone, true);
</span><del>-        userAgentShadowRoot()-&gt;insertBefore(m_placeholder, innerTextElement()-&gt;nextSibling());
</del><ins>+        userAgentShadowRoot()-&gt;insertBefore(*m_placeholder, innerTextElement()-&gt;nextSibling());
</ins><span class="cx">     }
</span><span class="cx">     m_placeholder-&gt;setInnerText(placeholderText, ASSERT_NO_EXCEPTION);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlImageDocumentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/ImageDocument.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/ImageDocument.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/ImageDocument.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx"> 
</span><span class="cx"> class ImageDocumentElement final : public HTMLImageElement {
</span><span class="cx"> public:
</span><del>-    static RefPtr&lt;ImageDocumentElement&gt; create(ImageDocument&amp;);
</del><ins>+    static Ref&lt;ImageDocumentElement&gt; create(ImageDocument&amp;);
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     ImageDocumentElement(ImageDocument&amp; document)
</span><span class="lines">@@ -107,9 +107,9 @@
</span><span class="cx">     ImageDocument* m_imageDocument;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-inline RefPtr&lt;ImageDocumentElement&gt; ImageDocumentElement::create(ImageDocument&amp; document)
</del><ins>+inline Ref&lt;ImageDocumentElement&gt; ImageDocumentElement::create(ImageDocument&amp; document)
</ins><span class="cx"> {
</span><del>-    return adoptRef(new ImageDocumentElement(document));
</del><ins>+    return adoptRef(*new ImageDocumentElement(document));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // --------
</span><span class="lines">@@ -210,19 +210,19 @@
</span><span class="cx"> 
</span><span class="cx"> void ImageDocument::createDocumentStructure()
</span><span class="cx"> {
</span><del>-    RefPtr&lt;Element&gt; rootElement = Document::createElement(htmlTag, false);
-    appendChild(rootElement);
-    downcast&lt;HTMLHtmlElement&gt;(*rootElement).insertedByParser();
</del><ins>+    Ref&lt;Element&gt; rootElement = Document::createElement(htmlTag, false);
+    appendChild(rootElement.copyRef());
+    downcast&lt;HTMLHtmlElement&gt;(rootElement.get()).insertedByParser();
</ins><span class="cx"> 
</span><span class="cx">     frame()-&gt;injectUserScripts(InjectAtDocumentStart);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; body = Document::createElement(bodyTag, false);
</del><ins>+    Ref&lt;Element&gt; body = Document::createElement(bodyTag, false);
</ins><span class="cx">     body-&gt;setAttribute(styleAttr, &quot;margin: 0px&quot;);
</span><span class="cx">     if (MIMETypeRegistry::isPDFMIMEType(document().loader()-&gt;responseMIMEType()))
</span><del>-        downcast&lt;HTMLBodyElement&gt;(*body).setInlineStyleProperty(CSSPropertyBackgroundColor, &quot;white&quot;, CSSPrimitiveValue::CSS_IDENT);
-    rootElement-&gt;appendChild(body);
</del><ins>+        downcast&lt;HTMLBodyElement&gt;(body.get()).setInlineStyleProperty(CSSPropertyBackgroundColor, &quot;white&quot;, CSSPrimitiveValue::CSS_IDENT);
+    rootElement-&gt;appendChild(body.copyRef());
</ins><span class="cx">     
</span><del>-    RefPtr&lt;ImageDocumentElement&gt; imageElement = ImageDocumentElement::create(*this);
</del><ins>+    Ref&lt;ImageDocumentElement&gt; imageElement = ImageDocumentElement::create(*this);
</ins><span class="cx">     if (m_shouldShrinkImage)
</span><span class="cx">         imageElement-&gt;setAttribute(styleAttr, &quot;-webkit-user-select:none; display:block; margin:auto;&quot;);
</span><span class="cx">     else
</span><span class="lines">@@ -230,7 +230,7 @@
</span><span class="cx">     imageElement-&gt;setLoadManually(true);
</span><span class="cx">     imageElement-&gt;setSrc(url().string());
</span><span class="cx">     imageElement-&gt;cachedImage()-&gt;setResponse(loader()-&gt;response());
</span><del>-    body-&gt;appendChild(imageElement);
</del><ins>+    body-&gt;appendChild(imageElement.copyRef());
</ins><span class="cx">     
</span><span class="cx">     if (m_shouldShrinkImage) {
</span><span class="cx"> #if PLATFORM(IOS)
</span><span class="lines">@@ -244,7 +244,7 @@
</span><span class="cx"> #endif
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    m_imageElement = imageElement.get();
</del><ins>+    m_imageElement = imageElement.ptr();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ImageDocument::imageUpdated()
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlMediaDocumentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/MediaDocument.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/MediaDocument.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/MediaDocument.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -78,30 +78,30 @@
</span><span class="cx">     
</span><span class="cx"> void MediaDocumentParser::createDocumentStructure()
</span><span class="cx"> {
</span><del>-    RefPtr&lt;Element&gt; rootElement = document()-&gt;createElement(htmlTag, false);
-    document()-&gt;appendChild(rootElement, IGNORE_EXCEPTION);
-    document()-&gt;setCSSTarget(rootElement.get());
-    downcast&lt;HTMLHtmlElement&gt;(*rootElement).insertedByParser();
</del><ins>+    Ref&lt;Element&gt; rootElement = document()-&gt;createElement(htmlTag, false);
+    document()-&gt;appendChild(rootElement.copyRef(), IGNORE_EXCEPTION);
+    document()-&gt;setCSSTarget(rootElement.ptr());
+    downcast&lt;HTMLHtmlElement&gt;(rootElement.get()).insertedByParser();
</ins><span class="cx"> 
</span><span class="cx">     if (document()-&gt;frame())
</span><span class="cx">         document()-&gt;frame()-&gt;injectUserScripts(InjectAtDocumentStart);
</span><span class="cx"> 
</span><span class="cx"> #if PLATFORM(IOS)
</span><del>-    RefPtr&lt;Element&gt; headElement = document()-&gt;createElement(headTag, false);
-    rootElement-&gt;appendChild(headElement, IGNORE_EXCEPTION);
</del><ins>+    Ref&lt;Element&gt; headElement = document()-&gt;createElement(headTag, false);
+    rootElement-&gt;appendChild(headElement.copyRef(), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; metaElement = document()-&gt;createElement(metaTag, false);
</del><ins>+    Ref&lt;Element&gt; metaElement = document()-&gt;createElement(metaTag, false);
</ins><span class="cx">     metaElement-&gt;setAttribute(nameAttr, &quot;viewport&quot;);
</span><span class="cx">     metaElement-&gt;setAttribute(contentAttr, &quot;width=device-width,initial-scale=1,user-scalable=no&quot;);
</span><del>-    headElement-&gt;appendChild(metaElement, IGNORE_EXCEPTION);
</del><ins>+    headElement-&gt;appendChild(WTF::move(metaElement), IGNORE_EXCEPTION);
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; body = document()-&gt;createElement(bodyTag, false);
-    rootElement-&gt;appendChild(body, IGNORE_EXCEPTION);
</del><ins>+    Ref&lt;Element&gt; body = document()-&gt;createElement(bodyTag, false);
+    rootElement-&gt;appendChild(body.copyRef(), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; mediaElement = document()-&gt;createElement(videoTag, false);
</del><ins>+    Ref&lt;Element&gt; mediaElement = document()-&gt;createElement(videoTag, false);
</ins><span class="cx"> 
</span><del>-    m_mediaElement = downcast&lt;HTMLVideoElement&gt;(mediaElement.get());
</del><ins>+    m_mediaElement = downcast&lt;HTMLVideoElement&gt;(mediaElement.ptr());
</ins><span class="cx">     m_mediaElement-&gt;setAttribute(controlsAttr, emptyAtom);
</span><span class="cx">     m_mediaElement-&gt;setAttribute(autoplayAttr, emptyAtom);
</span><span class="cx"> 
</span><span class="lines">@@ -114,15 +114,15 @@
</span><span class="cx"> #endif
</span><span class="cx">     m_mediaElement-&gt;setAttribute(styleAttr, elementStyle.toString());
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; sourceElement = document()-&gt;createElement(sourceTag, false);
-    HTMLSourceElement&amp; source = downcast&lt;HTMLSourceElement&gt;(*sourceElement);
</del><ins>+    Ref&lt;Element&gt; sourceElement = document()-&gt;createElement(sourceTag, false);
+    HTMLSourceElement&amp; source = downcast&lt;HTMLSourceElement&gt;(sourceElement.get());
</ins><span class="cx">     source.setSrc(document()-&gt;url());
</span><span class="cx"> 
</span><span class="cx">     if (DocumentLoader* loader = document()-&gt;loader())
</span><span class="cx">         source.setType(loader-&gt;responseMIMEType());
</span><span class="cx"> 
</span><del>-    m_mediaElement-&gt;appendChild(sourceElement, IGNORE_EXCEPTION);
-    body-&gt;appendChild(mediaElement, IGNORE_EXCEPTION);
</del><ins>+    m_mediaElement-&gt;appendChild(WTF::move(sourceElement), IGNORE_EXCEPTION);
+    body-&gt;appendChild(WTF::move(mediaElement), IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     Frame* frame = document()-&gt;frame();
</span><span class="cx">     if (!frame)
</span><span class="lines">@@ -253,7 +253,7 @@
</span><span class="cx">         if (documentLoader)
</span><span class="cx">             embedElement.setAttribute(typeAttr, documentLoader-&gt;writer().mimeType());
</span><span class="cx"> 
</span><del>-        videoElement-&gt;parentNode()-&gt;replaceChild(&amp;embedElement, videoElement, IGNORE_EXCEPTION);
</del><ins>+        videoElement-&gt;parentNode()-&gt;replaceChild(embedElement, *videoElement, IGNORE_EXCEPTION);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlPluginDocumentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/PluginDocument.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/PluginDocument.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/PluginDocument.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -67,9 +67,9 @@
</span><span class="cx"> 
</span><span class="cx"> void PluginDocumentParser::createDocumentStructure()
</span><span class="cx"> {
</span><del>-    RefPtr&lt;Element&gt; rootElement = document()-&gt;createElement(htmlTag, false);
-    document()-&gt;appendChild(rootElement, IGNORE_EXCEPTION);
-    downcast&lt;HTMLHtmlElement&gt;(*rootElement).insertedByParser();
</del><ins>+    Ref&lt;Element&gt; rootElement = document()-&gt;createElement(htmlTag, false);
+    document()-&gt;appendChild(rootElement.copyRef(), IGNORE_EXCEPTION);
+    downcast&lt;HTMLHtmlElement&gt;(rootElement.get()).insertedByParser();
</ins><span class="cx"> 
</span><span class="cx">     if (document()-&gt;frame())
</span><span class="cx">         document()-&gt;frame()-&gt;injectUserScripts(InjectAtDocumentStart);
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx">     document()-&gt;processViewport(ASCIILiteral(&quot;user-scalable=no&quot;), ViewportArguments::PluginDocument);
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; body = document()-&gt;createElement(bodyTag, false);
</del><ins>+    Ref&lt;Element&gt; body = document()-&gt;createElement(bodyTag, false);
</ins><span class="cx">     body-&gt;setAttribute(marginwidthAttr, AtomicString(&quot;0&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx">     body-&gt;setAttribute(marginheightAttr, AtomicString(&quot;0&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx"> #if PLATFORM(IOS)
</span><span class="lines">@@ -88,11 +88,11 @@
</span><span class="cx">     body-&gt;setAttribute(styleAttr, AtomicString(&quot;background-color: rgb(38,38,38)&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    rootElement-&gt;appendChild(body, IGNORE_EXCEPTION);
</del><ins>+    rootElement-&gt;appendChild(body.copyRef(), IGNORE_EXCEPTION);
</ins><span class="cx">         
</span><del>-    RefPtr&lt;Element&gt; embedElement = document()-&gt;createElement(embedTag, false);
</del><ins>+    Ref&lt;Element&gt; embedElement = document()-&gt;createElement(embedTag, false);
</ins><span class="cx">         
</span><del>-    m_embedElement = downcast&lt;HTMLEmbedElement&gt;(embedElement.get());
</del><ins>+    m_embedElement = downcast&lt;HTMLEmbedElement&gt;(embedElement.ptr());
</ins><span class="cx">     m_embedElement-&gt;setAttribute(widthAttr, &quot;100%&quot;);
</span><span class="cx">     m_embedElement-&gt;setAttribute(heightAttr, &quot;100%&quot;);
</span><span class="cx">     
</span><span class="lines">@@ -106,7 +106,7 @@
</span><span class="cx"> 
</span><span class="cx">     downcast&lt;PluginDocument&gt;(*document()).setPluginElement(m_embedElement);
</span><span class="cx"> 
</span><del>-    body-&gt;appendChild(embedElement, IGNORE_EXCEPTION);
</del><ins>+    body-&gt;appendChild(WTF::move(embedElement), IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void PluginDocumentParser::appendBytes(DocumentWriter&amp;, const char*, size_t)
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlRangeInputTypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/RangeInputType.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/RangeInputType.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/RangeInputType.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -253,12 +253,12 @@
</span><span class="cx">     ASSERT(element().userAgentShadowRoot());
</span><span class="cx"> 
</span><span class="cx">     Document&amp; document = element().document();
</span><del>-    RefPtr&lt;HTMLDivElement&gt; track = HTMLDivElement::create(document);
</del><ins>+    Ref&lt;HTMLDivElement&gt; track = HTMLDivElement::create(document);
</ins><span class="cx">     track-&gt;setPseudo(AtomicString(&quot;-webkit-slider-runnable-track&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx">     track-&gt;appendChild(SliderThumbElement::create(document), IGNORE_EXCEPTION);
</span><del>-    RefPtr&lt;HTMLElement&gt; container = SliderContainerElement::create(document);
-    container-&gt;appendChild(track.release(), IGNORE_EXCEPTION);
-    element().userAgentShadowRoot()-&gt;appendChild(container.release(), IGNORE_EXCEPTION);
</del><ins>+    Ref&lt;HTMLElement&gt; container = SliderContainerElement::create(document);
+    container-&gt;appendChild(WTF::move(track), IGNORE_EXCEPTION);
+    element().userAgentShadowRoot()-&gt;appendChild(WTF::move(container), IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> HTMLElement* RangeInputType::sliderTrackElement() const
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlSearchInputTypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/SearchInputType.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/SearchInputType.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/SearchInputType.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -107,14 +107,14 @@
</span><span class="cx">     ASSERT(container);
</span><span class="cx">     ASSERT(textWrapper);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;SearchFieldResultsButtonElement&gt; resultsButton = SearchFieldResultsButtonElement::create(element().document());
-    m_resultsButton = resultsButton.get();
-    updateResultButtonPseudoType(*m_resultsButton, element().maxResults());
-    container-&gt;insertBefore(m_resultsButton, textWrapper, IGNORE_EXCEPTION);
</del><ins>+    Ref&lt;SearchFieldResultsButtonElement&gt; resultsButton = SearchFieldResultsButtonElement::create(element().document());
+    m_resultsButton = resultsButton.ptr();
+    updateResultButtonPseudoType(resultsButton.get(), element().maxResults());
+    container-&gt;insertBefore(WTF::move(resultsButton), textWrapper, IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;SearchFieldCancelButtonElement&gt; cancelButton = SearchFieldCancelButtonElement::create(element().document());
-    m_cancelButton = cancelButton.get();
-    container-&gt;insertBefore(m_cancelButton, textWrapper-&gt;nextSibling(), IGNORE_EXCEPTION);
</del><ins>+    Ref&lt;SearchFieldCancelButtonElement&gt; cancelButton = SearchFieldCancelButtonElement::create(element().document());
+    m_cancelButton = cancelButton.ptr();
+    container-&gt;insertBefore(WTF::move(cancelButton), textWrapper-&gt;nextSibling(), IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> HTMLElement* SearchInputType::resultsButtonElement() const
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlTextFieldInputTypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/TextFieldInputType.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/TextFieldInputType.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/TextFieldInputType.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -274,7 +274,7 @@
</span><span class="cx">     m_innerText = TextControlInnerTextElement::create(document);
</span><span class="cx"> 
</span><span class="cx">     if (!createsContainer) {
</span><del>-        element().userAgentShadowRoot()-&gt;appendChild(m_innerText, IGNORE_EXCEPTION);
</del><ins>+        element().userAgentShadowRoot()-&gt;appendChild(*m_innerText, IGNORE_EXCEPTION);
</ins><span class="cx">         updatePlaceholderText();
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -284,7 +284,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (shouldHaveSpinButton) {
</span><span class="cx">         m_innerSpinButton = SpinButtonElement::create(document, *this);
</span><del>-        m_container-&gt;appendChild(m_innerSpinButton, IGNORE_EXCEPTION);
</del><ins>+        m_container-&gt;appendChild(*m_innerSpinButton, IGNORE_EXCEPTION);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (shouldHaveCapsLockIndicator) {
</span><span class="lines">@@ -294,7 +294,7 @@
</span><span class="cx">         bool shouldDrawCapsLockIndicator = this-&gt;shouldDrawCapsLockIndicator();
</span><span class="cx">         m_capsLockIndicator-&gt;setInlineStyleProperty(CSSPropertyDisplay, shouldDrawCapsLockIndicator ? CSSValueBlock : CSSValueNone, true);
</span><span class="cx"> 
</span><del>-        m_container-&gt;appendChild(m_capsLockIndicator, IGNORE_EXCEPTION);
</del><ins>+        m_container-&gt;appendChild(*m_capsLockIndicator, IGNORE_EXCEPTION);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     updateAutoFillButton();
</span><span class="lines">@@ -461,7 +461,7 @@
</span><span class="cx">     String placeholderText = element().strippedPlaceholder();
</span><span class="cx">     if (placeholderText.isEmpty()) {
</span><span class="cx">         if (m_placeholder) {
</span><del>-            m_placeholder-&gt;parentNode()-&gt;removeChild(m_placeholder.get(), ASSERT_NO_EXCEPTION);
</del><ins>+            m_placeholder-&gt;parentNode()-&gt;removeChild(*m_placeholder, ASSERT_NO_EXCEPTION);
</ins><span class="cx">             m_placeholder = nullptr;
</span><span class="cx">         }
</span><span class="cx">         return;
</span><span class="lines">@@ -470,7 +470,7 @@
</span><span class="cx">         m_placeholder = HTMLDivElement::create(element().document());
</span><span class="cx">         m_placeholder-&gt;setPseudo(AtomicString(&quot;-webkit-input-placeholder&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx">         m_placeholder-&gt;setInlineStyleProperty(CSSPropertyDisplay, element().isPlaceholderVisible() ? CSSValueBlock : CSSValueNone, true);
</span><del>-        element().userAgentShadowRoot()-&gt;insertBefore(m_placeholder, m_container ? m_container.get() : innerTextElement(), ASSERT_NO_EXCEPTION);
</del><ins>+        element().userAgentShadowRoot()-&gt;insertBefore(*m_placeholder, m_container ? m_container.get() : innerTextElement(), ASSERT_NO_EXCEPTION);
</ins><span class="cx">         
</span><span class="cx">     }
</span><span class="cx">     m_placeholder-&gt;setInnerText(placeholderText, ASSERT_NO_EXCEPTION);
</span><span class="lines">@@ -600,10 +600,10 @@
</span><span class="cx">     m_container-&gt;setPseudo(AtomicString(&quot;-webkit-textfield-decoration-container&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx"> 
</span><span class="cx">     m_innerBlock = TextControlInnerElement::create(element().document());
</span><del>-    m_innerBlock-&gt;appendChild(m_innerText, IGNORE_EXCEPTION);
-    m_container-&gt;appendChild(m_innerBlock, IGNORE_EXCEPTION);
</del><ins>+    m_innerBlock-&gt;appendChild(*m_innerText, IGNORE_EXCEPTION);
+    m_container-&gt;appendChild(*m_innerBlock, IGNORE_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    element().userAgentShadowRoot()-&gt;appendChild(m_container, IGNORE_EXCEPTION);
</del><ins>+    element().userAgentShadowRoot()-&gt;appendChild(*m_container, IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void TextFieldInputType::createAutoFillButton()
</span><span class="lines">@@ -612,7 +612,7 @@
</span><span class="cx"> 
</span><span class="cx">     m_autoFillButton = AutoFillButtonElement::create(element().document(), *this);
</span><span class="cx">     m_autoFillButton-&gt;setPseudo(AtomicString(&quot;-webkit-auto-fill-button&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    m_container-&gt;appendChild(m_autoFillButton, IGNORE_EXCEPTION);
</del><ins>+    m_container-&gt;appendChild(*m_autoFillButton, IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void TextFieldInputType::updateAutoFillButton()
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlValidationMessagecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/ValidationMessage.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/ValidationMessage.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/ValidationMessage.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -180,32 +180,32 @@
</span><span class="cx">     // Need to force position:absolute because RenderMenuList doesn't assume it
</span><span class="cx">     // contains non-absolute or non-fixed renderers as children.
</span><span class="cx">     m_bubble-&gt;setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
</span><del>-    shadowRoot.appendChild(m_bubble.get(), ASSERT_NO_EXCEPTION);
</del><ins>+    shadowRoot.appendChild(*m_bubble, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     document.updateLayout();
</span><span class="cx">     adjustBubblePosition(m_element-&gt;renderer()-&gt;absoluteBoundingBoxRect(), m_bubble.get());
</span><span class="cx"> 
</span><del>-    RefPtr&lt;HTMLDivElement&gt; clipper = HTMLDivElement::create(document);
</del><ins>+    Ref&lt;HTMLDivElement&gt; clipper = HTMLDivElement::create(document);
</ins><span class="cx">     clipper-&gt;setPseudo(AtomicString(&quot;-webkit-validation-bubble-arrow-clipper&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    RefPtr&lt;HTMLDivElement&gt; bubbleArrow = HTMLDivElement::create(document);
</del><ins>+    Ref&lt;HTMLDivElement&gt; bubbleArrow = HTMLDivElement::create(document);
</ins><span class="cx">     bubbleArrow-&gt;setPseudo(AtomicString(&quot;-webkit-validation-bubble-arrow&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    clipper-&gt;appendChild(bubbleArrow.release(), ASSERT_NO_EXCEPTION);
-    m_bubble-&gt;appendChild(clipper.release(), ASSERT_NO_EXCEPTION);
</del><ins>+    clipper-&gt;appendChild(WTF::move(bubbleArrow), ASSERT_NO_EXCEPTION);
+    m_bubble-&gt;appendChild(WTF::move(clipper), ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;HTMLElement&gt; message = HTMLDivElement::create(document);
</del><ins>+    Ref&lt;HTMLElement&gt; message = HTMLDivElement::create(document);
</ins><span class="cx">     message-&gt;setPseudo(AtomicString(&quot;-webkit-validation-bubble-message&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    RefPtr&lt;HTMLElement&gt; icon = HTMLDivElement::create(document);
</del><ins>+    Ref&lt;HTMLElement&gt; icon = HTMLDivElement::create(document);
</ins><span class="cx">     icon-&gt;setPseudo(AtomicString(&quot;-webkit-validation-bubble-icon&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    message-&gt;appendChild(icon.release(), ASSERT_NO_EXCEPTION);
-    RefPtr&lt;HTMLElement&gt; textBlock = HTMLDivElement::create(document);
</del><ins>+    message-&gt;appendChild(WTF::move(icon), ASSERT_NO_EXCEPTION);
+    Ref&lt;HTMLElement&gt; textBlock = HTMLDivElement::create(document);
</ins><span class="cx">     textBlock-&gt;setPseudo(AtomicString(&quot;-webkit-validation-bubble-text-block&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx">     m_messageHeading = HTMLDivElement::create(document);
</span><span class="cx">     m_messageHeading-&gt;setPseudo(AtomicString(&quot;-webkit-validation-bubble-heading&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    textBlock-&gt;appendChild(m_messageHeading, ASSERT_NO_EXCEPTION);
</del><ins>+    textBlock-&gt;appendChild(*m_messageHeading, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     m_messageBody = HTMLDivElement::create(document);
</span><span class="cx">     m_messageBody-&gt;setPseudo(AtomicString(&quot;-webkit-validation-bubble-body&quot;, AtomicString::ConstructFromLiteral));
</span><del>-    textBlock-&gt;appendChild(m_messageBody, ASSERT_NO_EXCEPTION);
-    message-&gt;appendChild(textBlock.release(), ASSERT_NO_EXCEPTION);
-    m_bubble-&gt;appendChild(message.release(), ASSERT_NO_EXCEPTION);
</del><ins>+    textBlock-&gt;appendChild(*m_messageBody, ASSERT_NO_EXCEPTION);
+    message-&gt;appendChild(WTF::move(textBlock), ASSERT_NO_EXCEPTION);
+    m_bubble-&gt;appendChild(WTF::move(message), ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     setMessageDOMAndStartTimer();
</span><span class="cx"> 
</span><span class="lines">@@ -237,7 +237,7 @@
</span><span class="cx">     if (m_bubble) {
</span><span class="cx">         m_messageHeading = nullptr;
</span><span class="cx">         m_messageBody = nullptr;
</span><del>-        m_element-&gt;userAgentShadowRoot()-&gt;removeChild(m_bubble.get(), ASSERT_NO_EXCEPTION);
</del><ins>+        m_element-&gt;userAgentShadowRoot()-&gt;removeChild(*m_bubble, ASSERT_NO_EXCEPTION);
</ins><span class="cx">         m_bubble = nullptr;
</span><span class="cx">     }
</span><span class="cx">     m_message = String();
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlshadowMediaControlElementscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/shadow/MediaControlElements.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/shadow/MediaControlElements.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/shadow/MediaControlElements.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -807,21 +807,21 @@
</span><span class="cx">     CaptionUserPreferences* captionPreferences = document().page()-&gt;group().captionPreferences();
</span><span class="cx">     Vector&lt;RefPtr&lt;TextTrack&gt;&gt; tracksForMenu = captionPreferences-&gt;sortedTrackListForMenu(trackList);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Element&gt; captionsHeader = document().createElement(h3Tag, ASSERT_NO_EXCEPTION);
</del><ins>+    Ref&lt;Element&gt; captionsHeader = document().createElement(h3Tag, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     captionsHeader-&gt;appendChild(document().createTextNode(textTrackSubtitlesText()));
</span><del>-    appendChild(captionsHeader);
-    RefPtr&lt;Element&gt; captionsMenuList = document().createElement(ulTag, ASSERT_NO_EXCEPTION);
</del><ins>+    appendChild(WTF::move(captionsHeader));
+    Ref&lt;Element&gt; captionsMenuList = document().createElement(ulTag, ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     for (unsigned i = 0, length = tracksForMenu.size(); i &lt; length; ++i) {
</span><span class="cx">         RefPtr&lt;TextTrack&gt; textTrack = tracksForMenu[i];
</span><del>-        RefPtr&lt;Element&gt; menuItem = document().createElement(liTag, ASSERT_NO_EXCEPTION);
</del><ins>+        Ref&lt;Element&gt; menuItem = document().createElement(liTag, ASSERT_NO_EXCEPTION);
</ins><span class="cx">         menuItem-&gt;appendChild(document().createTextNode(captionPreferences-&gt;displayNameForTrack(textTrack.get())));
</span><del>-        captionsMenuList-&gt;appendChild(menuItem);
-        m_menuItems.append(menuItem);
-        m_menuToTrackMap.add(menuItem, textTrack);
</del><ins>+        captionsMenuList-&gt;appendChild(menuItem.copyRef());
+        m_menuItems.append(menuItem.ptr());
+        m_menuToTrackMap.add(menuItem.ptr(), textTrack);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    appendChild(captionsMenuList);
</del><ins>+    appendChild(WTF::move(captionsMenuList));
</ins><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1186,16 +1186,16 @@
</span><span class="cx">             // track cue region identifier, run the following substeps:
</span><span class="cx">             if (displayBox-&gt;hasChildNodes() &amp;&amp; !contains(displayBox.get())) {
</span><span class="cx">                 // Note: the display tree of a cue is removed when the active flag of the cue is unset.
</span><del>-                appendChild(displayBox, ASSERT_NO_EXCEPTION);
</del><ins>+                appendChild(*displayBox, ASSERT_NO_EXCEPTION);
</ins><span class="cx">                 cue-&gt;setFontSize(m_fontSize, m_videoDisplaySize.size(), m_fontSizeIsImportant);
</span><span class="cx">             }
</span><span class="cx">         } else {
</span><span class="cx">             // Let region be the WebVTT region whose region identifier
</span><span class="cx">             // matches the text track cue region identifier of cue.
</span><del>-            RefPtr&lt;HTMLDivElement&gt; regionNode = region-&gt;getDisplayTree();
</del><ins>+            Ref&lt;HTMLDivElement&gt; regionNode = region-&gt;getDisplayTree();
</ins><span class="cx"> 
</span><span class="cx">             // Append the region to the viewport, if it was not already.
</span><del>-            if (!contains(regionNode.get()))
</del><ins>+            if (!contains(regionNode.ptr()))
</ins><span class="cx">                 appendChild(region-&gt;getDisplayTree());
</span><span class="cx"> 
</span><span class="cx">             region-&gt;appendTextTrackCueBox(displayBox);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlshadowMediaControlscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/shadow/MediaControls.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/shadow/MediaControls.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/shadow/MediaControls.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -380,14 +380,14 @@
</span><span class="cx">     if (m_textDisplayContainer)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlTextTrackContainerElement&gt; textDisplayContainer = MediaControlTextTrackContainerElement::create(document());
-    m_textDisplayContainer = textDisplayContainer.get();
</del><ins>+    Ref&lt;MediaControlTextTrackContainerElement&gt; textDisplayContainer = MediaControlTextTrackContainerElement::create(document());
+    m_textDisplayContainer = textDisplayContainer.ptr();
</ins><span class="cx"> 
</span><span class="cx">     if (m_mediaController)
</span><span class="cx">         m_textDisplayContainer-&gt;setMediaController(m_mediaController);
</span><span class="cx"> 
</span><span class="cx">     // Insert it before the first controller element so it always displays behind the controls.
</span><del>-    insertBefore(textDisplayContainer.release(), m_panel, IGNORE_EXCEPTION);
</del><ins>+    insertBefore(WTF::move(textDisplayContainer), m_panel, IGNORE_EXCEPTION);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void MediaControls::showTextTrackDisplay()
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlshadowMediaControlsApplecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/shadow/MediaControlsApple.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/shadow/MediaControlsApple.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/shadow/MediaControlsApple.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -63,165 +63,165 @@
</span><span class="cx"> PassRefPtr&lt;MediaControlsApple&gt; MediaControlsApple::createControls(Document&amp; document)
</span><span class="cx"> {
</span><span class="cx">     if (!document.page())
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     RefPtr&lt;MediaControlsApple&gt; controls = adoptRef(new MediaControlsApple(document));
</span><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlPanelElement&gt; panel = MediaControlPanelElement::create(document);
</del><ins>+    Ref&lt;MediaControlPanelElement&gt; panel = MediaControlPanelElement::create(document);
</ins><span class="cx"> 
</span><span class="cx">     ExceptionCode ec;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlRewindButtonElement&gt; rewindButton = MediaControlRewindButtonElement::create(document);
-    controls-&gt;m_rewindButton = rewindButton.get();
-    panel-&gt;appendChild(rewindButton.release(), ec);
</del><ins>+    Ref&lt;MediaControlRewindButtonElement&gt; rewindButton = MediaControlRewindButtonElement::create(document);
+    controls-&gt;m_rewindButton = rewindButton.ptr();
+    panel-&gt;appendChild(WTF::move(rewindButton), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlPlayButtonElement&gt; playButton = MediaControlPlayButtonElement::create(document);
-    controls-&gt;m_playButton = playButton.get();
-    panel-&gt;appendChild(playButton.release(), ec);
</del><ins>+    Ref&lt;MediaControlPlayButtonElement&gt; playButton = MediaControlPlayButtonElement::create(document);
+    controls-&gt;m_playButton = playButton.ptr();
+    panel-&gt;appendChild(WTF::move(playButton), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlReturnToRealtimeButtonElement&gt; returnToRealtimeButton = MediaControlReturnToRealtimeButtonElement::create(document);
-    controls-&gt;m_returnToRealTimeButton = returnToRealtimeButton.get();
-    panel-&gt;appendChild(returnToRealtimeButton.release(), ec);
</del><ins>+    Ref&lt;MediaControlReturnToRealtimeButtonElement&gt; returnToRealtimeButton = MediaControlReturnToRealtimeButtonElement::create(document);
+    controls-&gt;m_returnToRealTimeButton = returnToRealtimeButton.ptr();
+    panel-&gt;appendChild(WTF::move(returnToRealtimeButton), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     if (document.page()-&gt;theme().usesMediaControlStatusDisplay()) {
</span><del>-        RefPtr&lt;MediaControlStatusDisplayElement&gt; statusDisplay = MediaControlStatusDisplayElement::create(document);
-        controls-&gt;m_statusDisplay = statusDisplay.get();
-        panel-&gt;appendChild(statusDisplay.release(), ec);
</del><ins>+        Ref&lt;MediaControlStatusDisplayElement&gt; statusDisplay = MediaControlStatusDisplayElement::create(document);
+        controls-&gt;m_statusDisplay = statusDisplay.ptr();
+        panel-&gt;appendChild(WTF::move(statusDisplay), ec);
</ins><span class="cx">         if (ec)
</span><del>-            return 0;
</del><ins>+            return nullptr;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlTimelineContainerElement&gt; timelineContainer = MediaControlTimelineContainerElement::create(document);
</del><ins>+    Ref&lt;MediaControlTimelineContainerElement&gt; timelineContainer = MediaControlTimelineContainerElement::create(document);
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlCurrentTimeDisplayElement&gt; currentTimeDisplay = MediaControlCurrentTimeDisplayElement::create(document);
-    controls-&gt;m_currentTimeDisplay = currentTimeDisplay.get();
-    timelineContainer-&gt;appendChild(currentTimeDisplay.release(), ec);
</del><ins>+    Ref&lt;MediaControlCurrentTimeDisplayElement&gt; currentTimeDisplay = MediaControlCurrentTimeDisplayElement::create(document);
+    controls-&gt;m_currentTimeDisplay = currentTimeDisplay.ptr();
+    timelineContainer-&gt;appendChild(WTF::move(currentTimeDisplay), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlTimelineElement&gt; timeline = MediaControlTimelineElement::create(document, controls.get());
-    controls-&gt;m_timeline = timeline.get();
-    timelineContainer-&gt;appendChild(timeline.release(), ec);
</del><ins>+    Ref&lt;MediaControlTimelineElement&gt; timeline = MediaControlTimelineElement::create(document, controls.get());
+    controls-&gt;m_timeline = timeline.ptr();
+    timelineContainer-&gt;appendChild(WTF::move(timeline), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlTimeRemainingDisplayElement&gt; timeRemainingDisplay = MediaControlTimeRemainingDisplayElement::create(document);
-    controls-&gt;m_timeRemainingDisplay = timeRemainingDisplay.get();
-    timelineContainer-&gt;appendChild(timeRemainingDisplay.release(), ec);
</del><ins>+    Ref&lt;MediaControlTimeRemainingDisplayElement&gt; timeRemainingDisplay = MediaControlTimeRemainingDisplayElement::create(document);
+    controls-&gt;m_timeRemainingDisplay = timeRemainingDisplay.ptr();
+    timelineContainer-&gt;appendChild(WTF::move(timeRemainingDisplay), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    controls-&gt;m_timelineContainer = timelineContainer.get();
-    panel-&gt;appendChild(timelineContainer.release(), ec);
</del><ins>+    controls-&gt;m_timelineContainer = timelineContainer.ptr();
+    panel-&gt;appendChild(WTF::move(timelineContainer), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: Only create when needed &lt;http://webkit.org/b/57163&gt;
</span><del>-    RefPtr&lt;MediaControlSeekBackButtonElement&gt; seekBackButton = MediaControlSeekBackButtonElement::create(document);
-    controls-&gt;m_seekBackButton = seekBackButton.get();
-    panel-&gt;appendChild(seekBackButton.release(), ec);
</del><ins>+    Ref&lt;MediaControlSeekBackButtonElement&gt; seekBackButton = MediaControlSeekBackButtonElement::create(document);
+    controls-&gt;m_seekBackButton = seekBackButton.ptr();
+    panel-&gt;appendChild(WTF::move(seekBackButton), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: Only create when needed &lt;http://webkit.org/b/57163&gt;
</span><del>-    RefPtr&lt;MediaControlSeekForwardButtonElement&gt; seekForwardButton = MediaControlSeekForwardButtonElement::create(document);
-    controls-&gt;m_seekForwardButton = seekForwardButton.get();
-    panel-&gt;appendChild(seekForwardButton.release(), ec);
</del><ins>+    Ref&lt;MediaControlSeekForwardButtonElement&gt; seekForwardButton = MediaControlSeekForwardButtonElement::create(document);
+    controls-&gt;m_seekForwardButton = seekForwardButton.ptr();
+    panel-&gt;appendChild(WTF::move(seekForwardButton), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     if (document.page()-&gt;theme().supportsClosedCaptioning()) {
</span><del>-        RefPtr&lt;MediaControlClosedCaptionsContainerElement&gt; closedCaptionsContainer = MediaControlClosedCaptionsContainerElement::create(document);
</del><ins>+        Ref&lt;MediaControlClosedCaptionsContainerElement&gt; closedCaptionsContainer = MediaControlClosedCaptionsContainerElement::create(document);
</ins><span class="cx"> 
</span><del>-        RefPtr&lt;MediaControlClosedCaptionsTrackListElement&gt; closedCaptionsTrackList = MediaControlClosedCaptionsTrackListElement::create(document, controls.get());
-        controls-&gt;m_closedCaptionsTrackList = closedCaptionsTrackList.get();
-        closedCaptionsContainer-&gt;appendChild(closedCaptionsTrackList.release(), ec);
</del><ins>+        Ref&lt;MediaControlClosedCaptionsTrackListElement&gt; closedCaptionsTrackList = MediaControlClosedCaptionsTrackListElement::create(document, controls.get());
+        controls-&gt;m_closedCaptionsTrackList = closedCaptionsTrackList.ptr();
+        closedCaptionsContainer-&gt;appendChild(WTF::move(closedCaptionsTrackList), ec);
</ins><span class="cx">         if (ec)
</span><del>-            return 0;
</del><ins>+            return nullptr;
</ins><span class="cx"> 
</span><del>-        RefPtr&lt;MediaControlToggleClosedCaptionsButtonElement&gt; toggleClosedCaptionsButton = MediaControlToggleClosedCaptionsButtonElement::create(document, controls.get());
-        controls-&gt;m_toggleClosedCaptionsButton = toggleClosedCaptionsButton.get();
-        panel-&gt;appendChild(toggleClosedCaptionsButton.release(), ec);
</del><ins>+        Ref&lt;MediaControlToggleClosedCaptionsButtonElement&gt; toggleClosedCaptionsButton = MediaControlToggleClosedCaptionsButtonElement::create(document, controls.get());
+        controls-&gt;m_toggleClosedCaptionsButton = toggleClosedCaptionsButton.ptr();
+        panel-&gt;appendChild(WTF::move(toggleClosedCaptionsButton), ec);
</ins><span class="cx">         if (ec)
</span><del>-            return 0;
</del><ins>+            return nullptr;
</ins><span class="cx"> 
</span><del>-        controls-&gt;m_closedCaptionsContainer = closedCaptionsContainer.get();
-        controls-&gt;appendChild(closedCaptionsContainer.release(), ec);
</del><ins>+        controls-&gt;m_closedCaptionsContainer = closedCaptionsContainer.ptr();
+        controls-&gt;appendChild(WTF::move(closedCaptionsContainer), ec);
</ins><span class="cx">         if (ec)
</span><del>-            return 0;
</del><ins>+            return nullptr;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // FIXME: Only create when needed &lt;http://webkit.org/b/57163&gt;
</span><del>-    RefPtr&lt;MediaControlFullscreenButtonElement&gt; fullScreenButton = MediaControlFullscreenButtonElement::create(document);
-    controls-&gt;m_fullScreenButton = fullScreenButton.get();
-    panel-&gt;appendChild(fullScreenButton.release(), ec);
</del><ins>+    Ref&lt;MediaControlFullscreenButtonElement&gt; fullScreenButton = MediaControlFullscreenButtonElement::create(document);
+    controls-&gt;m_fullScreenButton = fullScreenButton.ptr();
+    panel-&gt;appendChild(WTF::move(fullScreenButton), ec);
</ins><span class="cx"> 
</span><span class="cx">     // The mute button and the slider element should be in the same div.
</span><del>-    RefPtr&lt;HTMLDivElement&gt; panelVolumeControlContainer = HTMLDivElement::create(document);
</del><ins>+    Ref&lt;HTMLDivElement&gt; panelVolumeControlContainer = HTMLDivElement::create(document);
</ins><span class="cx"> 
</span><span class="cx">     if (document.page()-&gt;theme().usesMediaControlVolumeSlider()) {
</span><del>-        RefPtr&lt;MediaControlVolumeSliderContainerElement&gt; volumeSliderContainer = MediaControlVolumeSliderContainerElement::create(document);
</del><ins>+        Ref&lt;MediaControlVolumeSliderContainerElement&gt; volumeSliderContainer = MediaControlVolumeSliderContainerElement::create(document);
</ins><span class="cx"> 
</span><del>-        RefPtr&lt;MediaControlPanelVolumeSliderElement&gt; slider = MediaControlPanelVolumeSliderElement::create(document);
-        controls-&gt;m_volumeSlider = slider.get();
-        volumeSliderContainer-&gt;appendChild(slider.release(), ec);
</del><ins>+        Ref&lt;MediaControlPanelVolumeSliderElement&gt; slider = MediaControlPanelVolumeSliderElement::create(document);
+        controls-&gt;m_volumeSlider = slider.ptr();
+        volumeSliderContainer-&gt;appendChild(WTF::move(slider), ec);
</ins><span class="cx">         if (ec)
</span><del>-            return 0;
</del><ins>+            return nullptr;
</ins><span class="cx"> 
</span><span class="cx">         // This is a duplicate mute button, which is visible in some ports at the bottom of the volume bar.
</span><span class="cx">         // It's important only when the volume bar is displayed below the controls.
</span><del>-        RefPtr&lt;MediaControlVolumeSliderMuteButtonElement&gt; volumeSliderMuteButton = MediaControlVolumeSliderMuteButtonElement::create(document);
-        controls-&gt;m_volumeSliderMuteButton = volumeSliderMuteButton.get();
-        volumeSliderContainer-&gt;appendChild(volumeSliderMuteButton.release(), ec);
</del><ins>+        Ref&lt;MediaControlVolumeSliderMuteButtonElement&gt; volumeSliderMuteButton = MediaControlVolumeSliderMuteButtonElement::create(document);
+        controls-&gt;m_volumeSliderMuteButton = volumeSliderMuteButton.ptr();
+        volumeSliderContainer-&gt;appendChild(WTF::move(volumeSliderMuteButton), ec);
</ins><span class="cx"> 
</span><span class="cx">         if (ec)
</span><del>-            return 0;
</del><ins>+            return nullptr;
</ins><span class="cx"> 
</span><del>-        controls-&gt;m_volumeSliderContainer = volumeSliderContainer.get();
-        panelVolumeControlContainer-&gt;appendChild(volumeSliderContainer.release(), ec);
</del><ins>+        controls-&gt;m_volumeSliderContainer = volumeSliderContainer.ptr();
+        panelVolumeControlContainer-&gt;appendChild(WTF::move(volumeSliderContainer), ec);
</ins><span class="cx">         if (ec)
</span><del>-            return 0;
</del><ins>+            return nullptr;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlPanelMuteButtonElement&gt; panelMuteButton = MediaControlPanelMuteButtonElement::create(document, controls.get());
-    controls-&gt;m_panelMuteButton = panelMuteButton.get();
-    panelVolumeControlContainer-&gt;appendChild(panelMuteButton.release(), ec);
</del><ins>+    Ref&lt;MediaControlPanelMuteButtonElement&gt; panelMuteButton = MediaControlPanelMuteButtonElement::create(document, controls.get());
+    controls-&gt;m_panelMuteButton = panelMuteButton.ptr();
+    panelVolumeControlContainer-&gt;appendChild(WTF::move(panelMuteButton), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    panel-&gt;appendChild(panelVolumeControlContainer, ec);
</del><ins>+    panel-&gt;appendChild(WTF::move(panelVolumeControlContainer), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: Only create when needed &lt;http://webkit.org/b/57163&gt;
</span><del>-    RefPtr&lt;MediaControlFullscreenVolumeMinButtonElement&gt; fullScreenMinVolumeButton = MediaControlFullscreenVolumeMinButtonElement::create(document);
-    controls-&gt;m_fullScreenMinVolumeButton = fullScreenMinVolumeButton.get();
-    panel-&gt;appendChild(fullScreenMinVolumeButton.release(), ec);
</del><ins>+    Ref&lt;MediaControlFullscreenVolumeMinButtonElement&gt; fullScreenMinVolumeButton = MediaControlFullscreenVolumeMinButtonElement::create(document);
+    controls-&gt;m_fullScreenMinVolumeButton = fullScreenMinVolumeButton.ptr();
+    panel-&gt;appendChild(WTF::move(fullScreenMinVolumeButton), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlFullscreenVolumeSliderElement&gt; fullScreenVolumeSlider = MediaControlFullscreenVolumeSliderElement::create(document);
-    controls-&gt;m_fullScreenVolumeSlider = fullScreenVolumeSlider.get();
-    panel-&gt;appendChild(fullScreenVolumeSlider.release(), ec);
</del><ins>+    Ref&lt;MediaControlFullscreenVolumeSliderElement&gt; fullScreenVolumeSlider = MediaControlFullscreenVolumeSliderElement::create(document);
+    controls-&gt;m_fullScreenVolumeSlider = fullScreenVolumeSlider.ptr();
+    panel-&gt;appendChild(WTF::move(fullScreenVolumeSlider), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    RefPtr&lt;MediaControlFullscreenVolumeMaxButtonElement&gt; fullScreenMaxVolumeButton = MediaControlFullscreenVolumeMaxButtonElement::create(document);
-    controls-&gt;m_fullScreenMaxVolumeButton = fullScreenMaxVolumeButton.get();
-    panel-&gt;appendChild(fullScreenMaxVolumeButton.release(), ec);
</del><ins>+    Ref&lt;MediaControlFullscreenVolumeMaxButtonElement&gt; fullScreenMaxVolumeButton = MediaControlFullscreenVolumeMaxButtonElement::create(document);
+    controls-&gt;m_fullScreenMaxVolumeButton = fullScreenMaxVolumeButton.ptr();
+    panel-&gt;appendChild(WTF::move(fullScreenMaxVolumeButton), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    controls-&gt;m_panel = panel.get();
-    controls-&gt;appendChild(panel.release(), ec);
</del><ins>+    controls-&gt;m_panel = panel.ptr();
+    controls-&gt;appendChild(WTF::move(panel), ec);
</ins><span class="cx">     if (ec)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     return controls.release();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlshadowSliderThumbElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/shadow/SliderThumbElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/shadow/SliderThumbElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/shadow/SliderThumbElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -612,7 +612,7 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Element&gt; SliderThumbElement::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</del><ins>+Ref&lt;Element&gt; SliderThumbElement::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</ins><span class="cx"> {
</span><span class="cx">     return create(targetDocument);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlshadowSliderThumbElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/shadow/SliderThumbElement.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/shadow/SliderThumbElement.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/shadow/SliderThumbElement.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -62,7 +62,7 @@
</span><span class="cx">     SliderThumbElement(Document&amp;);
</span><span class="cx"> 
</span><span class="cx">     virtual RenderPtr&lt;RenderElement&gt; createElementRenderer(Ref&lt;RenderStyle&gt;&amp;&amp;, const RenderTreePosition&amp;) override;
</span><del>-    virtual RefPtr&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;) override;
</del><ins>+    virtual Ref&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;) override;
</ins><span class="cx">     virtual bool isDisabledFormControl() const override;
</span><span class="cx">     virtual bool matchesReadWritePseudoClass() const override;
</span><span class="cx">     virtual Element* focusDelegate() override;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlshadowmacImageControlsRootElementMaccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/shadow/mac/ImageControlsRootElementMac.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/shadow/mac/ImageControlsRootElementMac.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/shadow/mac/ImageControlsRootElementMac.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -85,12 +85,13 @@
</span><span class="cx">     if (!document.page())
</span><span class="cx">         return nullptr;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;ImageControlsRootElementMac&gt; controls = adoptRef(*new ImageControlsRootElementMac(document));
</del><ins>+    Ref&lt;ImageControlsRootElementMac&gt; controls = adoptRef(*new ImageControlsRootElementMac(document));
</ins><span class="cx">     controls-&gt;setAttribute(HTMLNames::classAttr, &quot;x-webkit-image-controls&quot;);
</span><span class="cx"> 
</span><del>-    controls-&gt;appendChild(ImageControlsButtonElementMac::maybeCreate(document));
</del><ins>+    if (RefPtr&lt;ImageControlsButtonElementMac&gt; button = ImageControlsButtonElementMac::maybeCreate(document))
+        controls-&gt;appendChild(button.releaseNonNull());
</ins><span class="cx"> 
</span><del>-    return controls.release();
</del><ins>+    return WTF::move(controls);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ImageControlsRootElementMac::ImageControlsRootElementMac(Document&amp; document)
</span></span></pre></div>
<a id="trunkSourceWebCorehtmltrackVTTCuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/track/VTTCue.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/track/VTTCue.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/track/VTTCue.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -496,7 +496,7 @@
</span><span class="cx">             clonedNode = downcast&lt;WebVTTElement&gt;(*node).createEquivalentHTMLElement(ownerDocument());
</span><span class="cx">         else
</span><span class="cx">             clonedNode = node-&gt;cloneNode(false);
</span><del>-        parent-&gt;appendChild(clonedNode, ASSERT_NO_EXCEPTION);
</del><ins>+        parent-&gt;appendChild(*clonedNode, ASSERT_NO_EXCEPTION);
</ins><span class="cx">         if (is&lt;ContainerNode&gt;(*node))
</span><span class="cx">             copyWebVTTNodeToDOMTree(downcast&lt;ContainerNode&gt;(node), downcast&lt;ContainerNode&gt;(clonedNode.get()));
</span><span class="cx">     }
</span><span class="lines">@@ -518,10 +518,10 @@
</span><span class="cx">     RefPtr&lt;DocumentFragment&gt; clonedFragment;
</span><span class="cx">     createWebVTTNodeTree();
</span><span class="cx">     if (!m_webVTTNodeTree)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     clonedFragment = DocumentFragment::create(ownerDocument());
</span><del>-    m_webVTTNodeTree-&gt;cloneChildNodes(clonedFragment.get());
</del><ins>+    m_webVTTNodeTree-&gt;cloneChildNodes(*clonedFragment);
</ins><span class="cx">     return clonedFragment.release();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -785,7 +785,7 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     markFutureAndPastNodes(referenceTree.get(), startMediaTime(), movieTime);
</span><del>-    m_cueHighlightBox-&gt;appendChild(referenceTree);
</del><ins>+    m_cueHighlightBox-&gt;appendChild(referenceTree.releaseNonNull());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> VTTCueBox* VTTCue::getDisplayTree(const IntSize&amp; videoSize, int fontSize)
</span><span class="lines">@@ -812,8 +812,8 @@
</span><span class="cx">     m_cueHighlightBox-&gt;setPseudo(cueShadowPseudoId());
</span><span class="cx"> 
</span><span class="cx">     m_cueBackdropBox-&gt;setPseudo(cueBackdropShadowPseudoId());
</span><del>-    m_cueBackdropBox-&gt;appendChild(m_cueHighlightBox, ASSERT_NO_EXCEPTION);
-    displayTree-&gt;appendChild(m_cueBackdropBox, ASSERT_NO_EXCEPTION);
</del><ins>+    m_cueBackdropBox-&gt;appendChild(*m_cueHighlightBox, ASSERT_NO_EXCEPTION);
+    displayTree-&gt;appendChild(*m_cueBackdropBox, ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><span class="cx">     // FIXME(BUG 79916): Runs of children of WebVTT Ruby Objects that are not
</span><span class="cx">     // WebVTT Ruby Text Objects must be wrapped in anonymous boxes whose
</span></span></pre></div>
<a id="trunkSourceWebCorehtmltrackVTTRegioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/track/VTTRegion.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/track/VTTRegion.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/track/VTTRegion.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -354,7 +354,7 @@
</span><span class="cx">     if (m_cueContainer-&gt;contains(displayBox.get()))
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    m_cueContainer-&gt;appendChild(displayBox, ASSERT_NO_EXCEPTION);
</del><ins>+    m_cueContainer-&gt;appendChild(*displayBox, ASSERT_NO_EXCEPTION);
</ins><span class="cx">     displayLastTextTrackCueBox();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -404,14 +404,14 @@
</span><span class="cx">     m_cueContainer-&gt;setInlineStyleProperty(CSSPropertyTop, m_currentTop, CSSPrimitiveValue::CSS_PX);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;HTMLDivElement&gt; VTTRegion::getDisplayTree()
</del><ins>+HTMLDivElement&amp; VTTRegion::getDisplayTree()
</ins><span class="cx"> {
</span><span class="cx">     if (!m_regionDisplayTree) {
</span><span class="cx">         m_regionDisplayTree = HTMLDivElement::create(*ownerDocument());
</span><span class="cx">         prepareRegionDisplayTree();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return m_regionDisplayTree;
</del><ins>+    return *m_regionDisplayTree;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void VTTRegion::prepareRegionDisplayTree()
</span><span class="lines">@@ -453,7 +453,7 @@
</span><span class="cx">     m_cueContainer-&gt;setInlineStyleProperty(CSSPropertyTop, 0.0f, CSSPrimitiveValue::CSS_PX);
</span><span class="cx"> 
</span><span class="cx">     m_cueContainer-&gt;setPseudo(textTrackCueContainerShadowPseudoId());
</span><del>-    m_regionDisplayTree-&gt;appendChild(m_cueContainer);
</del><ins>+    m_regionDisplayTree-&gt;appendChild(*m_cueContainer);
</ins><span class="cx"> 
</span><span class="cx">     // 7.5 Every WebVTT region object is initialised with the following CSS
</span><span class="cx">     m_regionDisplayTree-&gt;setPseudo(textTrackRegionShadowPseudoId());
</span></span></pre></div>
<a id="trunkSourceWebCorehtmltrackVTTRegionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/track/VTTRegion.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/track/VTTRegion.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/track/VTTRegion.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -89,7 +89,7 @@
</span><span class="cx"> 
</span><span class="cx">     bool isScrollingRegion() { return m_scroll; }
</span><span class="cx"> 
</span><del>-    PassRefPtr&lt;HTMLDivElement&gt; getDisplayTree();
</del><ins>+    HTMLDivElement&amp; getDisplayTree();
</ins><span class="cx">     
</span><span class="cx">     void appendTextTrackCueBox(PassRefPtr&lt;VTTCueBox&gt;);
</span><span class="cx">     void displayLastTextTrackCueBox();
</span></span></pre></div>
<a id="trunkSourceWebCorehtmltrackWebVTTElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/track/WebVTTElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/track/WebVTTElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/track/WebVTTElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -80,11 +80,11 @@
</span><span class="cx">     return adoptRef(*new WebVTTElement(nodeType, document));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Element&gt; WebVTTElement::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</del><ins>+Ref&lt;Element&gt; WebVTTElement::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;WebVTTElement&gt; clone = create(static_cast&lt;WebVTTNodeType&gt;(m_webVTTNodeType), targetDocument);
</del><ins>+    Ref&lt;WebVTTElement&gt; clone = create(static_cast&lt;WebVTTNodeType&gt;(m_webVTTNodeType), targetDocument);
</ins><span class="cx">     clone-&gt;setLanguage(m_language);
</span><del>-    return clone;
</del><ins>+    return WTF::move(clone);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> PassRefPtr&lt;HTMLElement&gt; WebVTTElement::createEquivalentHTMLElement(Document&amp; document)
</span></span></pre></div>
<a id="trunkSourceWebCorehtmltrackWebVTTElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/track/WebVTTElement.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/track/WebVTTElement.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/html/track/WebVTTElement.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -49,7 +49,7 @@
</span><span class="cx">     static Ref&lt;WebVTTElement&gt; create(const WebVTTNodeType, Document&amp;);
</span><span class="cx">     PassRefPtr&lt;HTMLElement&gt; createEquivalentHTMLElement(Document&amp;);
</span><span class="cx"> 
</span><del>-    virtual RefPtr&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;) override;
</del><ins>+    virtual Ref&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;) override;
</ins><span class="cx"> 
</span><span class="cx">     void setWebVTTNodeType(WebVTTNodeType type) { m_webVTTNodeType = static_cast&lt;unsigned&gt;(type); }
</span><span class="cx">     WebVTTNodeType webVTTNodeType() const { return static_cast&lt;WebVTTNodeType&gt;(m_webVTTNodeType); }
</span></span></pre></div>
<a id="trunkSourceWebCoreinspectorInspectorCSSAgentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/inspector/InspectorCSSAgent.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/inspector/InspectorCSSAgent.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/inspector/InspectorCSSAgent.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -796,7 +796,7 @@
</span><span class="cx">     // Set this flag, so when we create it, we put it into the via inspector map.
</span><span class="cx">     m_creatingViaInspectorStyleSheet = true;
</span><span class="cx">     InlineStyleOverrideScope overrideScope(document);
</span><del>-    targetNode-&gt;appendChild(styleElement, ec);
</del><ins>+    targetNode-&gt;appendChild(styleElement.releaseNonNull(), ec);
</ins><span class="cx">     m_creatingViaInspectorStyleSheet = false;
</span><span class="cx">     if (ec)
</span><span class="cx">         return nullptr;
</span></span></pre></div>
<a id="trunkSourceWebCorepageDragControllercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/DragController.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/DragController.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/page/DragController.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -138,7 +138,7 @@
</span><span class="cx">             String title;
</span><span class="cx">             String url = dragData.asURL(DragData::DoNotConvertFilenames, &amp;title);
</span><span class="cx">             if (!url.isEmpty()) {
</span><del>-                RefPtr&lt;HTMLAnchorElement&gt; anchor = HTMLAnchorElement::create(document);
</del><ins>+                Ref&lt;HTMLAnchorElement&gt; anchor = HTMLAnchorElement::create(document);
</ins><span class="cx">                 anchor-&gt;setHref(url);
</span><span class="cx">                 if (title.isEmpty()) {
</span><span class="cx">                     // Try the plain text first because the url might be normalized or escaped.
</span><span class="lines">@@ -147,20 +147,19 @@
</span><span class="cx">                     if (title.isEmpty())
</span><span class="cx">                         title = url;
</span><span class="cx">                 }
</span><del>-                RefPtr&lt;Node&gt; anchorText = document.createTextNode(title);
-                anchor-&gt;appendChild(anchorText, IGNORE_EXCEPTION);
-                RefPtr&lt;DocumentFragment&gt; fragment = document.createDocumentFragment();
-                fragment-&gt;appendChild(anchor, IGNORE_EXCEPTION);
-                return fragment.get();
</del><ins>+                anchor-&gt;appendChild(document.createTextNode(title), IGNORE_EXCEPTION);
+                Ref&lt;DocumentFragment&gt; fragment = document.createDocumentFragment();
+                fragment-&gt;appendChild(WTF::move(anchor), IGNORE_EXCEPTION);
+                return fragment.ptr();
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx">     if (allowPlainText &amp;&amp; dragData.containsPlainText()) {
</span><span class="cx">         chosePlainText = true;
</span><del>-        return createFragmentFromText(context, dragData.asPlainText()).get();
</del><ins>+        return createFragmentFromText(context, dragData.asPlainText()).ptr();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return 0;
</del><ins>+    return nullptr;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool DragController::dragIsMove(FrameSelection&amp; selection, DragData&amp; dragData)
</span></span></pre></div>
<a id="trunkSourceWebCorepageiosFrameIOSmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/ios/FrameIOS.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/ios/FrameIOS.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/page/ios/FrameIOS.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -95,8 +95,8 @@
</span><span class="cx">     if (!style.isEmpty())
</span><span class="cx">         body-&gt;setAttribute(HTMLNames::styleAttr, style);
</span><span class="cx"> 
</span><del>-    rootElement-&gt;appendChild(body, ec);
-    document-&gt;appendChild(rootElement, ec);
</del><ins>+    rootElement-&gt;appendChild(body.releaseNonNull(), ec);
+    document-&gt;appendChild(rootElement.releaseNonNull(), ec);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> const ViewportArguments&amp; Frame::viewportArguments() const
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGScriptElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGScriptElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGScriptElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/svg/SVGScriptElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -156,9 +156,9 @@
</span><span class="cx">     return hasAttribute(XLinkNames::hrefAttr);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RefPtr&lt;Element&gt; SVGScriptElement::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</del><ins>+Ref&lt;Element&gt; SVGScriptElement::cloneElementWithoutAttributesAndChildren(Document&amp; targetDocument)
</ins><span class="cx"> {
</span><del>-    return adoptRef(new SVGScriptElement(tagQName(), targetDocument, false, alreadyStarted()));
</del><ins>+    return adoptRef(*new SVGScriptElement(tagQName(), targetDocument, false, alreadyStarted()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGScriptElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGScriptElement.h (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGScriptElement.h        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/svg/SVGScriptElement.h        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual void dispatchLoadEvent() override { SVGExternalResourcesRequired::dispatchLoadEvent(this); }
</span><span class="cx"> 
</span><del>-    virtual RefPtr&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;) override;
</del><ins>+    virtual Ref&lt;Element&gt; cloneElementWithoutAttributesAndChildren(Document&amp;) override;
</ins><span class="cx">     virtual bool rendererIsNeeded(const RenderStyle&amp;) override { return false; }
</span><span class="cx"> 
</span><span class="cx">     // SVGExternalResourcesRequired
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGUseElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGUseElement.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGUseElement.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/svg/SVGUseElement.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -332,7 +332,7 @@
</span><span class="cx">     for (auto* element : disallowedElements) {
</span><span class="cx">         for (auto&amp; descendant : descendantsOfType&lt;SVGElement&gt;(*element))
</span><span class="cx">             descendant.setCorrespondingElement(nullptr);
</span><del>-        element-&gt;parentNode()-&gt;removeChild(element);
</del><ins>+        element-&gt;parentNode()-&gt;removeChild(*element);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -405,7 +405,7 @@
</span><span class="cx"> 
</span><span class="cx"> void SVGUseElement::cloneTarget(ContainerNode&amp; container, SVGElement&amp; target) const
</span><span class="cx"> {
</span><del>-    Ref&lt;SVGElement&gt; targetClone = static_pointer_cast&lt;SVGElement&gt;(target.cloneElementWithChildren(document())).releaseNonNull();
</del><ins>+    Ref&lt;SVGElement&gt; targetClone = static_cast&lt;SVGElement&amp;&gt;(target.cloneElementWithChildren(document()).get());
</ins><span class="cx">     associateClonesWithOriginals(targetClone.get(), target);
</span><span class="cx">     removeDisallowedElementsFromSubtree(targetClone.get());
</span><span class="cx">     transferSizeAttributesToTargetClone(targetClone.get());
</span><span class="lines">@@ -419,7 +419,7 @@
</span><span class="cx">     ASSERT(!replacementClone.parentNode());
</span><span class="cx"> 
</span><span class="cx">     replacementClone.cloneDataFromElement(originalClone);
</span><del>-    originalClone.cloneChildNodes(&amp;replacementClone);
</del><ins>+    originalClone.cloneChildNodes(replacementClone);
</ins><span class="cx">     associateReplacementClonesWithOriginals(replacementClone, originalClone);
</span><span class="cx">     removeDisallowedElementsFromSubtree(replacementClone);
</span><span class="cx"> }
</span><span class="lines">@@ -448,7 +448,7 @@
</span><span class="cx">         if (target)
</span><span class="cx">             originalClone.cloneTarget(replacementClone.get(), *target);
</span><span class="cx"> 
</span><del>-        originalClone.parentNode()-&gt;replaceChild(replacementClone.ptr(), &amp;originalClone);
</del><ins>+        originalClone.parentNode()-&gt;replaceChild(replacementClone.copyRef(), originalClone);
</ins><span class="cx"> 
</span><span class="cx">         // Resume iterating, starting just inside the replacement clone.
</span><span class="cx">         it = descendants.from(replacementClone.get());
</span><span class="lines">@@ -472,7 +472,7 @@
</span><span class="cx">         auto replacementClone = SVGSVGElement::create(document());
</span><span class="cx">         cloneDataAndChildren(replacementClone.get(), originalClone);
</span><span class="cx"> 
</span><del>-        originalClone.parentNode()-&gt;replaceChild(replacementClone.ptr(), &amp;originalClone);
</del><ins>+        originalClone.parentNode()-&gt;replaceChild(replacementClone.copyRef(), originalClone);
</ins><span class="cx"> 
</span><span class="cx">         // Resume iterating, starting just inside the replacement clone.
</span><span class="cx">         it = descendants.from(replacementClone.get());
</span></span></pre></div>
<a id="trunkSourceWebCorexmlXMLTreeViewercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/xml/XMLTreeViewer.cpp (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/xml/XMLTreeViewer.cpp        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebCore/xml/XMLTreeViewer.cpp        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -61,8 +61,8 @@
</span><span class="cx">     m_document.frame()-&gt;script().evaluate(ScriptSourceCode(AtomicString(&quot;prepareWebKitXMLViewer('This XML file does not appear to have any style information associated with it. The document tree is shown below.');&quot;)));
</span><span class="cx"> 
</span><span class="cx">     String cssString = StringImpl::createWithoutCopying(XMLViewer_css, sizeof(XMLViewer_css));
</span><del>-    RefPtr&lt;Text&gt; text = m_document.createTextNode(cssString);
-    m_document.getElementById(String(ASCIILiteral(&quot;xml-viewer-style&quot;)))-&gt;appendChild(text, IGNORE_EXCEPTION);
</del><ins>+    Ref&lt;Text&gt; text = m_document.createTextNode(cssString);
+    m_document.getElementById(String(ASCIILiteral(&quot;xml-viewer-style&quot;)))-&gt;appendChild(WTF::move(text), IGNORE_EXCEPTION);
</ins><span class="cx">     m_document.styleResolverChanged(RecalcStyleImmediately);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebKitmacChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/ChangeLog (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/ChangeLog        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebKit/mac/ChangeLog        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,3 +1,18 @@
</span><ins>+2015-09-10  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Node.appendChild(null) / replaceChild(null, null) / removeChild(null) / insertBefore(null, ref) should throw a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=148971
+        &lt;rdar://problem/22560883&gt;
+        &lt;rdar://problem/22559225&gt;
+
+        Reviewed by Ryosuke Niwa.
+
+        ContainerNode::appendChild() now takes a Ref&lt;Node&gt;&amp;&amp; parameter so we
+        need to update the call site.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _documentFragmentWithNodesAsParagraphs:]):
+
</ins><span class="cx"> 2015-09-07  Andy Estes  &lt;aestes@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [Mac] DebugRelease builds should link against libWebKitSystemInterfaceElCapitan.a on 10.11
</span></span></pre></div>
<a id="trunkSourceWebKitmacWebViewWebFramemm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/WebView/WebFrame.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/WebView/WebFrame.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebKit/mac/WebView/WebFrame.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -890,9 +890,9 @@
</span><span class="cx">     RefPtr&lt;DocumentFragment&gt; fragment = document-&gt;createDocumentFragment();
</span><span class="cx"> 
</span><span class="cx">     for (auto* node : nodesVector) {
</span><del>-        RefPtr&lt;Element&gt; element = createDefaultParagraphElement(*document);
-        element-&gt;appendChild(node);
-        fragment-&gt;appendChild(element.release());
</del><ins>+        Ref&lt;Element&gt; element = createDefaultParagraphElement(*document);
+        element-&gt;appendChild(*node);
+        fragment-&gt;appendChild(WTF::move(element));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return kit(fragment.release().get());
</span><span class="lines">@@ -1873,7 +1873,7 @@
</span><span class="cx"> {
</span><span class="cx">     RefPtr&lt;Range&gt; range = _private-&gt;coreFrame-&gt;selection().toNormalizedRange();
</span><span class="cx"> 
</span><del>-    DOMDocumentFragment* fragment = range ? kit(createFragmentFromText(*range, text).get()) : nil;
</del><ins>+    DOMDocumentFragment* fragment = range ? kit(createFragmentFromText(*range, text).ptr()) : nil;
</ins><span class="cx">     [self _replaceSelectionWithFragment:fragment selectReplacement:selectReplacement smartReplace:smartReplace matchStyle:matchStyle];
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1958,7 +1958,7 @@
</span><span class="cx"> {
</span><span class="cx">     RefPtr&lt;Range&gt; range = _private-&gt;coreFrame-&gt;selection().toNormalizedRange();
</span><span class="cx">     
</span><del>-    DOMDocumentFragment* fragment = range ? kit(createFragmentFromText(*range, text).get()) : nil;
</del><ins>+    DOMDocumentFragment* fragment = range ? kit(createFragmentFromText(*range, text).ptr()) : nil;
</ins><span class="cx">     [self _replaceSelectionWithFragment:fragment selectReplacement:selectReplacement smartReplace:smartReplace matchStyle:YES];
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -2264,7 +2264,7 @@
</span><span class="cx"> #if PLATFORM(IOS)
</span><span class="cx"> - (DOMDocumentFragment *)_documentFragmentForText:(NSString *)text
</span><span class="cx"> {
</span><del>-    return kit(createFragmentFromText(*_private-&gt;coreFrame-&gt;selection().toNormalizedRange().get(), text).get());
</del><ins>+    return kit(createFragmentFromText(*_private-&gt;coreFrame-&gt;selection().toNormalizedRange().get(), text).ptr());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> - (DOMDocumentFragment *)_documentFragmentForWebArchive:(WebArchive *)webArchive
</span></span></pre></div>
<a id="trunkSourceWebKitmacWebViewWebHTMLViewmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/WebView/WebHTMLView.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/WebView/WebHTMLView.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebKit/mac/WebView/WebHTMLView.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -2267,7 +2267,7 @@
</span><span class="cx">     if (pboardType == NSStringPboardType) {
</span><span class="cx">         if (!context)
</span><span class="cx">             return nil;
</span><del>-        return kit(createFragmentFromText(*core(context), [[pasteboard stringForType:NSStringPboardType] precomposedStringWithCanonicalMapping]).get());
</del><ins>+        return kit(createFragmentFromText(*core(context), [[pasteboard stringForType:NSStringPboardType] precomposedStringWithCanonicalMapping]).ptr());
</ins><span class="cx">     }
</span><span class="cx">     return nil;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/ChangeLog (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/ChangeLog        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebKit2/ChangeLog        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2015-09-10  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Node.appendChild(null) / replaceChild(null, null) / removeChild(null) / insertBefore(null, ref) should throw a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=148971
+        &lt;rdar://problem/22560883&gt;
+        &lt;rdar://problem/22559225&gt;
+
+        Reviewed by Ryosuke Niwa.
+
+        ContainerNode::appendChild() now takes a Ref&lt;Node&gt;&amp;&amp; parameter so we
+        need to update the call sites.
+
+        * WebProcess/Plugins/PDF/PDFPlugin.mm:
+        (WebKit::PDFPlugin::PDFPlugin):
+        * WebProcess/Plugins/PDF/PDFPluginAnnotation.mm:
+        (WebKit::PDFPluginAnnotation::attach):
+        (WebKit::PDFPluginAnnotation::~PDFPluginAnnotation):
+        * WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm:
+        (WebKit::PDFPluginChoiceAnnotation::createAnnotationElement):
+
</ins><span class="cx"> 2015-09-10  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Web Inspector: Make WebInspectorProxy inspectorURL path methods static
</span></span></pre></div>
<a id="trunkSourceWebKit2WebProcessPluginsPDFPDFPluginmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -525,11 +525,11 @@
</span><span class="cx">         m_annotationContainer = document-&gt;createElement(divTag, false);
</span><span class="cx">         m_annotationContainer-&gt;setAttribute(idAttr, &quot;annotationContainer&quot;);
</span><span class="cx"> 
</span><del>-        RefPtr&lt;Element&gt; m_annotationStyle = document-&gt;createElement(styleTag, false);
-        m_annotationStyle-&gt;setTextContent(annotationStyle, ASSERT_NO_EXCEPTION);
</del><ins>+        Ref&lt;Element&gt; annotationStyleElement = document-&gt;createElement(styleTag, false);
+        annotationStyleElement-&gt;setTextContent(annotationStyle, ASSERT_NO_EXCEPTION);
</ins><span class="cx"> 
</span><del>-        m_annotationContainer-&gt;appendChild(m_annotationStyle.get());
-        document-&gt;bodyOrFrameset()-&gt;appendChild(m_annotationContainer.get());
</del><ins>+        m_annotationContainer-&gt;appendChild(WTF::move(annotationStyleElement));
+        document-&gt;bodyOrFrameset()-&gt;appendChild(*m_annotationContainer);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     m_accessibilityObject = adoptNS([[WKPDFPluginAccessibilityObject alloc] initWithPDFPlugin:this]);
</span></span></pre></div>
<a id="trunkSourceWebKit2WebProcessPluginsPDFPDFPluginAnnotationmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -74,7 +74,7 @@
</span><span class="cx"> 
</span><span class="cx">     updateGeometry();
</span><span class="cx"> 
</span><del>-    m_parent-&gt;appendChild(m_element);
</del><ins>+    m_parent-&gt;appendChild(*m_element);
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: The text cursor doesn't blink after this. Why?
</span><span class="cx">     m_element-&gt;focus();
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx"> 
</span><span class="cx">     m_eventListener-&gt;setAnnotation(0);
</span><span class="cx"> 
</span><del>-    m_parent-&gt;removeChild(element());
</del><ins>+    m_parent-&gt;removeChild(*element());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void PDFPluginAnnotation::updateGeometry()
</span></span></pre></div>
<a id="trunkSourceWebKit2WebProcessPluginsPDFPDFPluginChoiceAnnotationmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm (189575 => 189576)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm        2015-09-10 17:47:16 UTC (rev 189575)
+++ trunk/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm        2015-09-10 18:02:15 UTC (rev 189576)
</span><span class="lines">@@ -83,14 +83,14 @@
</span><span class="cx">     NSString *selectedChoice = choiceAnnotation.stringValue;
</span><span class="cx"> 
</span><span class="cx">     for (NSString *choice in choices) {
</span><del>-        RefPtr&lt;Element&gt; choiceOption = document.createElement(optionTag, false);
</del><ins>+        Ref&lt;Element&gt; choiceOption = document.createElement(optionTag, false);
</ins><span class="cx">         choiceOption-&gt;setAttribute(valueAttr, choice);
</span><span class="cx">         choiceOption-&gt;setTextContent(choice, ASSERT_NO_EXCEPTION);
</span><span class="cx"> 
</span><span class="cx">         if (choice == selectedChoice)
</span><span class="cx">             choiceOption-&gt;setAttribute(selectedAttr, &quot;selected&quot;);
</span><span class="cx"> 
</span><del>-        styledElement-&gt;appendChild(choiceOption);
</del><ins>+        styledElement-&gt;appendChild(WTF::move(choiceOption));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return element;
</span></span></pre>
</div>
</div>

</body>
</html>