REGRESSION (274894@main): [ iOS Debug ] accessibility/text-marker/tex…

…t-marker-range-stale-node-crash.html is a constant crash

https://bugs.webkit.org/show_bug.cgi?id=270477
rdar://124030130

Reviewed by Chris Dumez.

Node may have started destruction by the time the RefPtr is created.

* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::characterOffsetForTextMarkerData):

Canonical link: https://commits.webkit.org/275695@main

Source/WebCore/accessibility/AXObjectCache.cpp

@@ -2795,7 +2795,7 @@ CharacterOffset AXObjectCache::characterOffsetForTextMarkerData(TextMarkerData&
     if (textMarkerData.ignored)
         return { };
 
-    RefPtr node = textMarkerData.node;
+    RefPtrAllowingPartiallyDestroyed<Node> node = textMarkerData.node;
     if (!node || !isNodeInUse(*node))
         return { };