Deploy more smart pointers in AbortSignal.cpp, BroadcastChannel.cpp, …

…NodeRareData.h, and Range.cpp

https://bugs.webkit.org/show_bug.cgi?id=264624

Reviewed by Chris Dumez.

Deploy smart pointers as warned by the clang static analyzer.

* Source/WebCore/dom/AbortSignal.cpp:
(WebCore::AbortSignal::throwIfAborted):
* Source/WebCore/dom/BroadcastChannel.cpp:
(WebCore::BroadcastChannel::MainThreadBridge::MainThreadBridge):
* Source/WebCore/dom/NodeRareData.h:
(WebCore::NodeListsNodeData::removeChildNodeList):
(WebCore::NodeListsNodeData::removeEmptyChildNodeList):
* Source/WebCore/dom/Range.cpp:
(WebCore::Range::processContents):
(WebCore::Range::surroundContents):
(WebCore::boundaryTextNodesSplit):

Canonical link: https://commits.webkit.org/270578@main

Source/WebCore/dom/AbortSignal.cpp

@@ -207,7 +207,7 @@ void AbortSignal::throwIfAborted(JSC::JSGlobalObject& lexicalGlobalObject)
     if (!aborted())
         return;
 
-    auto& vm = lexicalGlobalObject.vm();
+    Ref vm = lexicalGlobalObject.vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
     throwException(&lexicalGlobalObject, scope, m_reason.getValue());
 }

Source/WebCore/dom/BroadcastChannel.cpp

@@ -96,7 +96,7 @@ BroadcastChannel::MainThreadBridge::MainThreadBridge(BroadcastChannel& channel,
     : m_broadcastChannel(channel)
     , m_identifier(BroadcastChannelIdentifier::generate())
     , m_name(name.isolatedCopy())
-    , m_origin(partitionedSecurityOriginFromContext(*channel.scriptExecutionContext()).isolatedCopy())
+    , m_origin(partitionedSecurityOriginFromContext(*channel.protectedScriptExecutionContext()).isolatedCopy())
 {
 }
 

Source/WebCore/dom/NodeRareData.h

@@ -68,7 +68,8 @@ class NodeListsNodeData {
     void removeChildNodeList(ChildNodeList* list)
     {
         ASSERT(m_childNodeList == list);
-        if (deleteThisAndUpdateNodeRareDataIfAboutToRemoveLastList(list->ownerNode()))
+        Ref ownerNode = list->ownerNode();
+        if (deleteThisAndUpdateNodeRareDataIfAboutToRemoveLastList(ownerNode))
             return;
         m_childNodeList = nullptr;
     }
@@ -86,7 +87,8 @@ class NodeListsNodeData {
     void removeEmptyChildNodeList(EmptyNodeList* list)
     {
         ASSERT(m_emptyChildNodeList == list);
-        if (deleteThisAndUpdateNodeRareDataIfAboutToRemoveLastList(list->ownerNode()))
+        Ref ownerNode = list->ownerNode();
+        if (deleteThisAndUpdateNodeRareDataIfAboutToRemoveLastList(ownerNode))
             return;
         m_emptyChildNodeList = nullptr;
     }

Source/WebCore/dom/Range.cpp

@@ -339,8 +339,8 @@ ExceptionOr<RefPtr<DocumentFragment>> Range::processContents(ActionType action)
     ASSERT(commonRoot);
 
     if (action == Extract) {
-        auto& commonRootDocument = commonRoot->document();
-        RefPtr doctype = commonRootDocument.doctype();
+        Ref commonRootDocument = commonRoot->document();
+        RefPtr doctype = commonRootDocument->doctype();
         if (doctype && contains(makeSimpleRange(*this), { *doctype, 0 }))
             return Exception { ExceptionCode::HierarchyRequestError };
     }
@@ -847,10 +847,10 @@ ExceptionOr<void> Range::surroundContents(Node& newParent)
     Ref protectedNewParent = newParent;
 
     // Step 1: If a non-Text node is partially contained in the context object, then throw an InvalidStateError.
-    Node* startNonTextContainer = &startContainer();
+    RefPtr startNonTextContainer = &startContainer();
     if (startNonTextContainer->nodeType() == Node::TEXT_NODE)
         startNonTextContainer = startNonTextContainer->parentNode();
-    Node* endNonTextContainer = &endContainer();
+    RefPtr endNonTextContainer = &endContainer();
     if (endNonTextContainer->nodeType() == Node::TEXT_NODE)
         endNonTextContainer = endNonTextContainer->parentNode();
     if (startNonTextContainer != endNonTextContainer)
@@ -1029,7 +1029,7 @@ void Range::textNodesMerged(NodeWithIndex& oldNode, unsigned offset)
 
 static inline void boundaryTextNodesSplit(RangeBoundaryPoint& boundary, Text& oldNode)
 {
-    auto* parent = oldNode.parentNode();
+    RefPtr parent = oldNode.parentNode();
     if (&boundary.container() == &oldNode) {
         unsigned splitOffset = oldNode.length();
         unsigned boundaryOffset = boundary.offset();