Attachment 359623 Details for Bug 175028 – Patch

[patch] Patch

bug-175028-20190119140507.patch (text/plain), 279.30 KB, created by Darin Adler on 2019-01-19 14:05:08 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Darin Adler

Created: 2019-01-19 14:05:08 PST

Size: 279.30 KB

patch

obsolete

>Subversion Revision: 240203
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index e0efae669a2071f2c1fe2d1f0521776e28de1078..503ba9be8412446a11feb15cf8706073e54b8fa6 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,447 @@
>+2019-01-15  Darin Adler  <darin@apple.com>
>+
>+        Use references rather than pointers for register/unregister functions, and more
>+        https://bugs.webkit.org/show_bug.cgi?id=175028
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * Modules/applepay/ApplePaySession.cpp:
>+        (WebCore::ApplePaySession::begin): Pass a reference.
>+        (WebCore::ApplePaySession::completePayment): Ditto.
>+        (WebCore::ApplePaySession::didReachFinalState): Ditto.
>+        * Modules/cache/DOMCache.cpp:
>+        (WebCore::DOMCache::retrieveRecords): Ditto.
>+        (WebCore::DOMCache::batchDeleteOperation): Ditto.
>+        (WebCore::DOMCache::batchPutOperation): Ditto.
>+        * Modules/cache/DOMCacheStorage.cpp:
>+        (WebCore::DOMCacheStorage::match): Ditto.
>+        * Modules/fetch/FetchBodyOwner.cpp:
>+        (WebCore::FetchBodyOwner::loadBlob): Ditto.
>+        (WebCore::FetchBodyOwner::finishBlobLoading): Ditto.
>+        * Modules/fetch/FetchBodySource.cpp:
>+        (WebCore::FetchBodySource::setActive): Ditto.
>+        (WebCore::FetchBodySource::setInactive): Ditto.
>+        * Modules/fetch/FetchResponse.cpp:
>+        (WebCore::FetchResponse::BodyLoader::BodyLoader): Ditto.
>+        (WebCore::FetchResponse::BodyLoader::~BodyLoader): Ditto.
>+        * Modules/mediasource/MediaSource.cpp:
>+        (WebCore::MediaSource::addedToRegistry): Ditto.
>+        (WebCore::MediaSource::removedFromRegistry): Ditto.
>+        * Modules/mediastream/MediaStream.cpp:
>+        (WebCore::MediaStream::~MediaStream): Ditto.
>+        (WebCore::MediaStream::startProducingData): Ditto.
>+        * Modules/mediastream/MediaStreamTrack.cpp:
>+        (WebCore::MediaStreamTrack::MediaStreamTrack): Ditto.
>+        (WebCore::MediaStreamTrack::~MediaStreamTrack): Ditto.
>+        * Modules/mediastream/RTCDataChannel.cpp:
>+        (WebCore::RTCDataChannel::create): Ditto.
>+        (WebCore::RTCDataChannel::close): Ditto.
>+        * Modules/mediastream/RTCPeerConnection.cpp:
>+        (WebCore::RTCPeerConnection::create): Use auto.
>+        * Modules/notifications/Notification.cpp:
>+        (WebCore::Notification::show): Pass a reference.
>+        (WebCore::Notification::finalize): Ditto.
>+        * Modules/webaudio/AudioBasicInspectorNode.cpp:
>+        (WebCore::AudioBasicInspectorNode::updatePullStatus): Ditto.
>+
>+        * Modules/webaudio/AudioContext.cpp:
>+        (WebCore::AudioContext::constructCommon): Ditto.
>+        (WebCore::AudioContext::lazyInitialize): Ditto.
>+        (WebCore::AudioContext::clear): Ditto.
>+        (WebCore::AudioContext::uninitialize): Ditto.
>+        (WebCore::AudioContext::markForDeletion): Take a reference.
>+        (WebCore::AudioContext::addAutomaticPullNode): Ditto.
>+        (WebCore::AudioContext::removeAutomaticPullNode): Ditto.
>+        (WebCore::AudioContext::willBeginPlayback): Pass a reference.
>+        (WebCore::AudioContext::willPausePlayback): Ditto.
>+        * Modules/webaudio/AudioContext.h: Update above functions to take
>+        references rather than pointers.
>+
>+        * Modules/webaudio/AudioNode.cpp:
>+        (WebCore::AudioNode::finishDeref): Pass a reference.
>+        * Modules/websockets/WebSocket.cpp:
>+        (WebCore::WebSocket::connect): Ditto.
>+        (WebCore::WebSocket::stop): Ditto.
>+        (WebCore::WebSocket::didClose): Ditto.
>+
>+        * WebCore.xcodeproj/project.pbxproj: Allowed Xcode to update this file.
>+
>+        * bindings/js/JSDOMWindowBase.cpp:
>+        (WebCore::JSDOMWindowBase::moduleLoaderResolve): Update since
>+        moduleLoader is now a reference.
>+        (WebCore::JSDOMWindowBase::moduleLoaderFetch): Ditto.
>+        (WebCore::JSDOMWindowBase::moduleLoaderEvaluate): Ditto.
>+        (WebCore::JSDOMWindowBase::moduleLoaderImportModule): Ditto.
>+        (WebCore::JSDOMWindowBase::moduleLoaderCreateImportMetaProperties): Ditto.
>+
>+        * dom/ActiveDOMObject.h:
>+        (WebCore::ActiveDOMObject::setPendingActivity): Take a reference.
>+        (WebCore::ActiveDOMObject::unsetPendingActivity): Ditto.
>+
>+        * dom/CharacterData.cpp:
>+        (WebCore::CharacterData::setData): Pass a reference.
>+        (WebCore::CharacterData::insertData): Ditto.
>+        (WebCore::CharacterData::deleteData): Ditto.
>+        (WebCore::CharacterData::replaceData): Ditto.
>+
>+        * dom/Document.cpp:
>+        (WebCore::Document::getElementByAccessKey): Pass a reference.
>+        (WebCore::Document::buildAccessKeyMap): Take a reference.
>+        (WebCore::Document::registerForVisibilityStateChangedCallbacks): Ditto.
>+        (WebCore::Document::unregisterForVisibilityStateChangedCallbacks): Ditto.
>+        (WebCore::Document::addAudioProducer): Ditto.
>+        (WebCore::Document::removeAudioProducer): Ditto.
>+        (WebCore::Document::hoveredElementDidDetach): Ditto.
>+        (WebCore::Document::elementInActiveChainDidDetach): Ditto.
>+        (WebCore::Document::attachNodeIterator): Ditto.
>+        (WebCore::Document::detachNodeIterator): Ditto.
>+        (WebCore::Document::moveNodeIteratorsToNewDocumentSlowCase): Pass
>+        a reference.
>+        (WebCore::Document::nodeChildrenWillBeRemoved): Ditto.
>+        (WebCore::Document::nodeWillBeRemoved): Ditto.
>+        (WebCore::Document::textInserted): Take a reference.
>+        (WebCore::Document::textRemoved): Ditto.
>+        (WebCore::Document::textNodesMerged): Ditto.
>+        (WebCore::Document::textNodeSplit): Ditto.
>+        (WebCore::Document::takeDOMWindowFrom): Ditto.
>+        (WebCore::Document::registerForDocumentSuspensionCallbacks): Ditto.
>+        (WebCore::Document::unregisterForDocumentSuspensionCallbacks): Ditto.
>+        (WebCore::Document::registerForMediaVolumeCallbacks): Ditto.
>+        (WebCore::Document::unregisterForMediaVolumeCallbacks): Ditto.
>+        (WebCore::Document::registerForPrivateBrowsingStateChangedCallbacks): Ditto.
>+        (WebCore::Document::unregisterForPrivateBrowsingStateChangedCallbacks): Ditto.
>+        (WebCore::Document::registerForCaptionPreferencesChangedCallbacks): Ditto.
>+        (WebCore::Document::unregisterForCaptionPreferencesChangedCallbacks): Ditto.
>+        (WebCore::Document::registerForPageScaleFactorChangedCallbacks): Ditto.
>+        (WebCore::Document::unregisterForPageScaleFactorChangedCallbacks): Ditto.
>+        (WebCore::Document::finishedParsing): Use a reference.
>+        (WebCore::Document::attachRange): Take a reference.
>+        (WebCore::Document::detachRange): Ditto.
>+        (WebCore::Document::suspendScheduledTasks): Use a reference.
>+        (WebCore::Document::resumeScheduledTasks): Ditto.
>+        (WebCore::Document::addMediaCanStartListener): Take a reference.
>+        (WebCore::Document::removeMediaCanStartListener): Ditto.
>+        (WebCore::Document::deviceMotionController const): Return a reference.
>+        (WebCore::Document::deviceOrientationController const): Ditto.
>+        (WebCore::Document::simulateDeviceOrientationChange): Use a reference.
>+        (WebCore::Document::fullScreenIsAllowedForElement const): Take a reference.
>+        (WebCore::Document::requestFullScreenForElement): Pass a reference.
>+        (WebCore::Document::webkitExitFullscreen): Ditto.
>+        (WebCore::Document::webkitWillEnterFullScreen): Renamed to remove the
>+        "ForElement" from the function name. Take a reference rather than a pointer.
>+        (WebCore::Document::webkitDidEnterFullScreen): Renamed to remove the
>+        "ForElement" from the function name and removed the unused element argument.
>+        (WebCore::Document::webkitWillExitFullScreen): Ditto.
>+        (WebCore::Document::webkitDidExitFullScreen): Ditto.
>+        (WebCore::Document::pushFullscreenElementStack): Take a reference.
>+        (WebCore::Document::addDocumentToFullScreenChangeEventQueue): Ditto.
>+        (WebCore::DocumentParserYieldToken::DocumentParserYieldToken): Use a reference.
>+        (WebCore::DocumentParserYieldToken::~DocumentParserYieldToken): Ditto.
>+        (WebCore::Document::updateHoverActiveState): Updated name of isInActiveChain.
>+
>+        * dom/Document.h: Updated argument types as described above. Changed a couple
>+        of inline functions to return references.
>+
>+        * dom/DocumentMarkerController.cpp:
>+        (WebCore::DocumentMarkerController::addMarker): Take a reference.
>+        (WebCore::DocumentMarkerController::addMarkerToNode): Ditto.
>+        (WebCore::DocumentMarkerController::addTextMatchMarker): Ditto.
>+        (WebCore::DocumentMarkerController::addDictationPhraseWithAlternativesMarker): Ditto.
>+        (WebCore::DocumentMarkerController::addDictationResultMarker): Ditto.
>+        (WebCore::DocumentMarkerController::addDraggedContentMarker): Ditto.
>+        (WebCore::DocumentMarkerController::removeMarkers): Ditto.
>+        (WebCore::DocumentMarkerController::copyMarkers): Ditto.
>+        (WebCore::DocumentMarkerController::shiftMarkers): Ditto.
>+        (WebCore::DocumentMarkerController::setMarkersActive): DItto.
>+        * dom/DocumentMarkerController.h: Updated argument types as described above.
>+
>+        * dom/Element.cpp:
>+        (WebCore::Element::~Element): Pass a reference.
>+        (WebCore::Element::isUserActionElementInActiveChain const): Updated name of
>+        isInActiveChain.
>+        (WebCore::Element::hasEquivalentAttributes const): Take a reference.
>+        (WebCore::Element::removedFromAncestor): Pass a reference.
>+        (WebCore::Element::clearHoverAndActiveStatusBeforeDetachingRenderer):
>+        Pass a reference and updated name of isInActiveChain.
>+
>+        * dom/Element.h: Renamed inActiveChain to isInActiveChain, updated argument
>+        types to be references, and removed unneeded friend declaration and made
>+        SynchronizationOfLazyAttribute private.
>+
>+        * dom/Node.cpp:
>+        (WebCore::Node::normalize): Pass a reference.
>+        (WebCore::Node::isEqualNode const): Ditto.
>+        * dom/NodeIterator.cpp:
>+        (WebCore::NodeIterator::NodeIterator): Ditto.
>+        (WebCore::NodeIterator::~NodeIterator): Ditto.
>+
>+        * dom/RadioButtonGroups.cpp:
>+        (WebCore::RadioButtonGroup::add): Take a reference.
>+        (WebCore::RadioButtonGroup::updateCheckedState): Ditto.
>+        (WebCore::RadioButtonGroup::remove): Ditto.
>+        (WebCore::RadioButtonGroup::contains const): Ditto.
>+        (WebCore::RadioButtonGroups::addButton): Ditto.
>+        (WebCore::RadioButtonGroups::updateCheckedState): Ditto.
>+        (WebCore::RadioButtonGroups::hasCheckedButton const): Ditto.
>+        (WebCore::RadioButtonGroups::isInRequiredGroup const): Ditto.
>+        (WebCore::RadioButtonGroups::removeButton): Ditto.
>+        * dom/RadioButtonGroups.h: Updated argument types.
>+
>+        * dom/Range.cpp:
>+        (WebCore::Range::Range): Pass a reference.
>+        (WebCore::Range::~Range): Ditto.
>+        (WebCore::Range::setDocument): Ditto.
>+        (WebCore::Range::createContextualFragment): Ditto.
>+        (WebCore::boundaryTextInserted): Ditto.
>+        (WebCore::Range::textInserted): Ditto.
>+        (WebCore::boundaryTextRemoved): Ditto.
>+        (WebCore::Range::textRemoved): Ditto.
>+        (WebCore::boundaryTextNodesSplit): Ditto.
>+        (WebCore::Range::textNodeSplit): Ditto.
>+        * dom/Range.h: Take references instead of pointers.
>+
>+        * dom/ScriptElement.cpp:
>+        (WebCore::ScriptElement::prepareScript): Use reference.
>+
>+        * dom/Text.cpp:
>+        (WebCore::Text::splitText): Pass reference.
>+
>+        * dom/UserActionElementSet.h: Renamed inActiveChain to isInActiveChain to
>+        match the naming scheme of the other similar functions, like isActive.
>+
>+        * editing/AlternativeTextController.cpp:
>+        (WebCore::AlternativeTextController::applyAlternativeTextToRange):
>+        Pass a reference.
>+        (WebCore::AlternativeTextController::respondToUnappliedSpellCorrection): Ditto.
>+        (WebCore::AlternativeTextController::handleAlternativeTextUIResult): Ditto.
>+        (WebCore::AlternativeTextController::respondToUnappliedEditing): Ditto.
>+        (WebCore::AlternativeTextController::markReversed): Ditto.
>+        (WebCore::AlternativeTextController::markCorrection): Ditto.
>+        (WebCore::AlternativeTextController::recordSpellcheckerResponseForModifiedCorrection): Ditto.
>+        (WebCore::AlternativeTextController::markPrecedingWhitespaceForDeletedAutocorrectionAfterCommand): Ditto.
>+        * editing/CompositeEditCommand.cpp:
>+        (WebCore::CompositeEditCommand::replaceTextInNodePreservingMarkers): Ditto.
>+        * editing/DictationCommand.cpp: Ditto.
>+        * editing/Editing.cpp:
>+        (WebCore::areIdenticalElements): Ditto.
>+        * editing/Editor.cpp:
>+        (WebCore::Editor::ignoreSpelling): Ditto.
>+        (WebCore::Editor::learnSpelling): Ditto.
>+        (WebCore::Editor::advanceToNextMisspelling): Ditto.
>+        (WebCore::Editor::clearMisspellingsAndBadGrammar): Ditto.
>+        (WebCore::Editor::markMisspellingsAfterTypingToWord): Ditto.
>+        (WebCore::Editor::markAndReplaceFor): Ditto.
>+        (WebCore::Editor::changeBackToReplacedString): Ditto.
>+        (WebCore::Editor::updateMarkersForWordsAffectedByEditing): Ditto.
>+        (WebCore::Editor::countMatchesForText): Ditto.
>+        (WebCore::Editor::scanRangeForTelephoneNumbers): Ditto.
>+        (WebCore::Editor::editorUIUpdateTimerFired): Ditto.
>+        (WebCore::Editor::handleAcceptedCandidate): Ditto.
>+
>+        * editing/InsertTextCommand.cpp:
>+        (WebCore::InsertTextCommand::doApply): Pass a reference.
>+        * editing/InsertTextCommand.h: Take a reference.
>+
>+        * editing/SpellChecker.cpp:
>+        (WebCore::SpellChecker::didCheckSucceed): Pass a reference.
>+        * editing/SplitTextNodeCommand.cpp:
>+        (WebCore::SplitTextNodeCommand::doApply): Ditto.
>+        (WebCore::SplitTextNodeCommand::doUnapply): Ditto.
>+        * editing/TextCheckingHelper.cpp:
>+        (WebCore::TextCheckingHelper::findFirstMisspelling): Pass a reference.
>+        (WebCore::TextCheckingHelper::findFirstGrammarDetail const): Ditto.
>+        * editing/ios/DictationCommandIOS.cpp:
>+        (WebCore::DictationCommandIOS::doApply): Ditto.
>+        Also added a comment about a possible missing null check; behavior should
>+        be no different than before, but using a reference helps make clear there
>+        was never any null check.
>+        * editing/ios/EditorIOS.mm:
>+        (WebCore::Editor::setDictationPhrasesAsChildOfElement): Ditto.
>+        * fileapi/FileReader.cpp:
>+        (WebCore::FileReader::readInternal): Ditto.
>+        (WebCore::FileReader::abort): Ditto.
>+        (WebCore::FileReader::didFinishLoading): Ditto.
>+        (WebCore::FileReader::didFail): Ditto.
>+
>+        * html/HTMLAppletElement.cpp: Removed unneeded include of HTMLDocument.h.
>+        There's very little left that is truly specific to HTMLDocument vs. Document.
>+
>+        * html/HTMLDocument.h:
>+        (WebCore::HTMLDocument::create): Take a reference.
>+        (WebCore::HTMLDocument::createSynthesizedDocument): Ditto.
>+
>+        * html/HTMLFormElement.cpp:
>+        (WebCore::HTMLFormElement::~HTMLFormElement): Pass a reference.
>+        (WebCore::HTMLFormElement::parseAttribute): Ditto.
>+        (WebCore::HTMLFormElement::didMoveToNewDocument): Ditto.
>+
>+        * html/HTMLIFrameElement.cpp: Removed unneeded include of HTMLDocument.h.
>+
>+        * html/HTMLInputElement.cpp:
>+        (WebCore::HTMLInputElement::~HTMLInputElement): Pass a reference.
>+        (WebCore::HTMLInputElement::setChecked): Ditto.
>+        (WebCore::HTMLInputElement::registerForSuspensionCallbackIfNeeded): Ditto.
>+        (WebCore::HTMLInputElement::unregisterForSuspensionCallbackIfNeeded): Ditto.
>+        (WebCore::HTMLInputElement::didMoveToNewDocument): Ditto.
>+        (WebCore::HTMLInputElement::isInRequiredRadioButtonGroup): Ditto.
>+        (WebCore::HTMLInputElement::addToRadioButtonGroup): Ditto.
>+        (WebCore::HTMLInputElement::removeFromRadioButtonGroup): Ditto.
>+        * html/HTMLMediaElement.cpp:
>+        (WebCore::HTMLMediaElement::registerWithDocument): Ditto.
>+        (WebCore::HTMLMediaElement::unregisterWithDocument): Ditto.
>+        (WebCore::HTMLMediaElement::selectMediaResource): Ditto.
>+        (WebCore::HTMLMediaElement::addTextTrack): Ditto.
>+        (WebCore::HTMLMediaElement::clearMediaPlayer): Ditto.
>+        (WebCore::HTMLMediaElement::resume): Ditto.
>+        (WebCore::HTMLMediaElement::setMediaControlsDependOnPageScaleFactor): Ditto.
>+
>+        * html/HTMLNameCollection.cpp: Removed unneeded include of HTMLDocument.h.
>+
>+        * html/HTMLPlugInImageElement.cpp:
>+        (WebCore::HTMLPlugInImageElement::~HTMLPlugInImageElement): Pass a reference.
>+        (WebCore::HTMLPlugInImageElement::createElementRenderer): Ditto.
>+        (WebCore::HTMLPlugInImageElement::didMoveToNewDocument): Ditto.
>+
>+        * html/HTMLSourceElement.cpp: Removed unneeded include of HTMLDocument.h.
>+        * html/HTMLTemplateElement.cpp: Ditto.
>+
>+        * html/RadioInputType.cpp:
>+        (WebCore::RadioInputType::matchesIndeterminatePseudoClass const):
>+        Pass a reference.
>+        * loader/DocumentWriter.cpp:
>+        (WebCore::DocumentWriter::begin): Ditto.
>+        * page/DOMWindow.cpp:
>+        (WebCore::DOMWindow::addEventListener): Ditto.
>+        (WebCore::DOMWindow::removeEventListener): Ditto.
>+        (WebCore::DOMWindow::removeAllEventListeners): Ditto.
>+
>+        * page/EventHandler.cpp:
>+        (WebCore::EventHandler::didStartDrag): Use a reference.
>+
>+        * page/EventSource.cpp:
>+        (WebCore::EventSource::create): Pass reference.
>+        (WebCore::EventSource::networkRequestEnded): Ditto.
>+        (WebCore::EventSource::close): Ditto.
>+        (WebCore::EventSource::abortConnectionAttempt): Ditto.
>+
>+        * page/Frame.cpp: Removed unneeded include of HTMLDocument.h.
>+        * page/FrameView.cpp: Ditto.
>+        (WebCore::FrameView::qualifiesAsVisuallyNonEmpty const): Use reference.
>+
>+        * page/animation/AnimationBase.cpp:
>+        (WebCore::AnimationBase::updateStateMachine): Pass reference.
>+
>+        * page/animation/CSSAnimationController.cpp:
>+        (WebCore::CSSAnimationControllerPrivate::addToAnimationsWaitingForStyle): Take reference.
>+        (WebCore::CSSAnimationControllerPrivate::removeFromAnimationsWaitingForStyle): Ditto.
>+        (WebCore::CSSAnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse): Ditto.
>+        (WebCore::CSSAnimationControllerPrivate::removeFromAnimationsWaitingForStartTimeResponse): Ditto.
>+        (WebCore::CSSAnimationControllerPrivate::animationWillBeRemoved): Ditto.
>+        * page/animation/CSSAnimationControllerPrivate.h: Ditto.
>+
>+        * page/animation/CompositeAnimation.cpp:
>+        (WebCore::CompositeAnimation::clearElement): Pass reference.
>+        (WebCore::CompositeAnimation::updateTransitions): Ditto.
>+        (WebCore::CompositeAnimation::updateKeyframeAnimations): Ditto.
>+        * page/ios/FrameIOS.mm:
>+        (WebCore::Frame::initWithSimpleHTMLDocument): Ditto.
>+
>+        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
>+        (WebCore::layerContentsFormat): Add ALLOW_DEPRECATED_DECLARATIONS_BEGIN/END so
>+        I can continue to compile with latest headers.
>+
>+        * rendering/CSSFilter.cpp:
>+        (WebCore::CSSFilter::buildReferenceFilter): Pass reference, small coding style
>+        tweaks as well.
>+
>+        * rendering/svg/RenderSVGResource.cpp:
>+        (WebCore::removeFromCacheAndInvalidateDependencies): Pass reference.
>+        * rendering/svg/RenderSVGResourceContainer.cpp:
>+        (WebCore::RenderSVGResourceContainer::registerResource): Ditto.
>+        * rendering/svg/SVGResources.cpp:
>+        (WebCore::registerPendingResource): Ditto.
>+        * rendering/svg/SVGResourcesCache.cpp:
>+        (WebCore::SVGResourcesCache::resourceDestroyed): Ditto.
>+
>+        * svg/SVGDocumentExtensions.cpp:
>+        (WebCore::SVGDocumentExtensions::addTimeContainer): Take reference.
>+        (WebCore::SVGDocumentExtensions::removeTimeContainer): Ditto.
>+        (WebCore::SVGDocumentExtensions::addResource): Ditto.
>+        (WebCore::SVGDocumentExtensions::addPendingResource): Ditto.
>+        (WebCore::SVGDocumentExtensions::isElementWithPendingResources const): Ditto.
>+        (WebCore::SVGDocumentExtensions::isPendingResource const): Ditto.
>+        (WebCore::SVGDocumentExtensions::clearHasPendingResourcesIfPossible): Ditto.
>+        (WebCore::SVGDocumentExtensions::removeElementFromPendingResources): Ditto.
>+        (WebCore::SVGDocumentExtensions::setOfElementsReferencingTarget): Ditto.
>+        (WebCore::SVGDocumentExtensions::addElementReferencingTarget): Ditto.
>+        (WebCore::SVGDocumentExtensions::removeAllTargetReferencesForElement): Ditto.
>+        (WebCore::SVGDocumentExtensions::clearTargetDependencies): Ditto.
>+        (WebCore::SVGDocumentExtensions::removeAllElementReferencesForTarget): Ditto.
>+        (WebCore::SVGDocumentExtensions::registerSVGFontFaceElement): Ditto.
>+        (WebCore::SVGDocumentExtensions::unregisterSVGFontFaceElement): Ditto.
>+        * svg/SVGDocumentExtensions.h: Ditto.
>+
>+        * svg/SVGElement.cpp:
>+        (WebCore::SVGElement::~SVGElement): Pass reference.
>+        (WebCore::SVGElement::removedFromAncestor): Ditto.
>+        (WebCore::SVGElement::buildPendingResourcesIfNeeded): Ditto.
>+        * svg/SVGFEImageElement.cpp:
>+        (WebCore::SVGFEImageElement::clearResourceReferences): Ditto.
>+        (WebCore::SVGFEImageElement::buildPendingResource): Ditto.
>+        * svg/SVGFontFaceElement.cpp:
>+        (WebCore::SVGFontFaceElement::insertedIntoAncestor): Ditto.
>+        (WebCore::SVGFontFaceElement::removedFromAncestor): Ditto.
>+        * svg/SVGMPathElement.cpp:
>+        (WebCore::SVGMPathElement::buildPendingResource): Ditto.
>+        (WebCore::SVGMPathElement::clearResourceReferences): Ditto.
>+        * svg/SVGPathElement.cpp:
>+        (WebCore::SVGPathElement::invalidateMPathDependencies): Ditto.
>+        * svg/SVGSVGElement.cpp:
>+        (WebCore::SVGSVGElement::SVGSVGElement): Ditto.
>+        (WebCore::SVGSVGElement::~SVGSVGElement): Ditto.
>+        (WebCore::SVGSVGElement::didMoveToNewDocument): Ditto.
>+        (WebCore::SVGSVGElement::insertedIntoAncestor): Ditto.
>+        (WebCore::SVGSVGElement::removedFromAncestor): Ditto.
>+        * svg/SVGTRefElement.cpp:
>+        (WebCore::SVGTRefElement::detachTarget): Ditto.
>+        (WebCore::SVGTRefElement::buildPendingResource): Ditto.
>+        * svg/SVGTextPathElement.cpp:
>+        (WebCore::SVGTextPathElement::clearResourceReferences): Ditto.
>+        (WebCore::SVGTextPathElement::buildPendingResource): Ditto.
>+        * svg/SVGUseElement.cpp:
>+        (WebCore::SVGUseElement::updateShadowTree): Ditto.
>+        * svg/animation/SVGSMILElement.cpp:
>+        (WebCore::SVGSMILElement::clearResourceReferences): Ditto.
>+        (WebCore::SVGSMILElement::buildPendingResource): Ditto.
>+        * testing/Internals.cpp:
>+        (WebCore::Internals::addTextMatchMarker): Ditto.
>+        (WebCore::Internals::webkitWillEnterFullScreenForElement): Ditto.
>+        (WebCore::Internals::webkitDidEnterFullScreenForElement): Ditto.
>+        (WebCore::Internals::webkitWillExitFullScreenForElement): Ditto.
>+        (WebCore::Internals::webkitDidExitFullScreenForElement): Ditto.
>+        * workers/Worker.cpp:
>+        (WebCore::Worker::create): Ditto.
>+        (WebCore::Worker::notifyFinished): Ditto.
>+        * workers/service/ServiceWorkerContainer.cpp:
>+        (WebCore::ServiceWorkerContainer::scheduleJob): Ditto.
>+        (WebCore::ServiceWorkerContainer::jobDidFinish): Ditto.
>+        * xml/XMLHttpRequest.cpp:
>+        (WebCore::XMLHttpRequest::prepareToSend): Ditto.
>+        (WebCore::XMLHttpRequest::createRequest): Ditto.
>+        (WebCore::XMLHttpRequest::internalAbort): Ditto.
>+        (WebCore::XMLHttpRequest::networkErrorTimerFired): Ditto.
>+        (WebCore::XMLHttpRequest::didFail): Ditto.
>+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
>+
>+        * xml/XPathStep.cpp: Removed unneeded include of HTMLDocument.h.
>+        (WebCore::XPath::nodeMatchesBasicTest): Changed code to call isHTMLDocument
>+        rather than is<HTMLDocument> since this is not a type check for a downcast,
>+        but rather a behavioral difference that does not depend on any of the data
>+        stored in an HTMLDocument or the use of a distinct C++ class for it.
>+
>+        * xml/XSLTProcessor.cpp:
>+        (WebCore::XSLTProcessor::createDocumentFromSource): Pass a reference.
>+
> 2019-01-19  Antoine Quint  <graouts@apple.com>
> 
>         Add a POINTER_EVENTS feature flag
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index 3404db13ed9d16f15dee0180c7f79daa30cd042d..b4009b0959dbd6c2528462f4435160bbc4ca1d82 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,25 @@
>+2019-01-15  Darin Adler  <darin@apple.com>
>+
>+        Use references rather than pointers for register/unregister functions, and more
>+        https://bugs.webkit.org/show_bug.cgi?id=175028
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * WebProcess/FullScreen/WebFullScreenManager.cpp:
>+        (WebKit::WebFullScreenManager::willEnterFullScreen): Update for change to the
>+        functions in Document; pass a reference.
>+        (WebKit::WebFullScreenManager::didEnterFullScreen): Ditto, don't pass the element.
>+        (WebKit::WebFullScreenManager::willExitFullScreen): Ditto.
>+        (WebKit::WebFullScreenManager::didExitFullScreen): Ditto.
>+
>+        * WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp:
>+        (WebKit::UserMediaPermissionRequestManager::startUserMediaRequest): Pass a reference.
>+        (WebKit::UserMediaPermissionRequestManager::mediaCanStart): Ditto.
>+        (WebKit::UserMediaPermissionRequestManager::removeMediaRequestFromMaps): Ditto.
>+        * WebProcess/Plugins/PluginView.cpp:
>+        (WebKit::PluginView::~PluginView): Ditto.
>+        (WebKit::PluginView::initializePlugin): Ditto.
>+
> 2019-01-19  David Kilzer  <ddkilzer@apple.com>
> 
>         Follow-up: iOS: Updating input mode should update the software keyboard
>diff --git a/Source/WebKitLegacy/ChangeLog b/Source/WebKitLegacy/ChangeLog
>index 1b4bbf75863c3607a0234e8e4fec0fa11c94aced..2e271c9ab4bec57df63ab402b02fff5e317b4bfe 100644
>--- a/Source/WebKitLegacy/ChangeLog
>+++ b/Source/WebKitLegacy/ChangeLog
>@@ -1,3 +1,12 @@
>+2019-01-15  Darin Adler  <darin@apple.com>
>+
>+        Use references rather than pointers for register/unregister functions, and more
>+        https://bugs.webkit.org/show_bug.cgi?id=175028
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * WebKitLegacy.xcodeproj/project.pbxproj: Let Xcode update this project.
>+
> 2019-01-18  Eric Carlson  <eric.carlson@apple.com>
> 
>         Revert r238815, it broke WK1 video fullscreen on Mac
>diff --git a/Source/WebKitLegacy/mac/ChangeLog b/Source/WebKitLegacy/mac/ChangeLog
>index 61a9d3693ecc93235a5da38e6ffa3fa250c52438..9a1e5332905f96676c315f556fb10564ad66a502 100644
>--- a/Source/WebKitLegacy/mac/ChangeLog
>+++ b/Source/WebKitLegacy/mac/ChangeLog
>@@ -1,3 +1,24 @@
>+2019-01-15  Darin Adler  <darin@apple.com>
>+
>+        Use references rather than pointers for register/unregister functions, and more
>+        https://bugs.webkit.org/show_bug.cgi?id=175028
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * WebCoreSupport/WebKitFullScreenListener.mm:
>+        (-[WebKitFullScreenListener webkitWillEnterFullScreen]): Update for change to the
>+        functions in Document; pass a reference.
>+        (-[WebKitFullScreenListener webkitDidEnterFullScreen]): Ditto, don't pass the element.
>+        (-[WebKitFullScreenListener webkitWillExitFullScreen]): Ditto.
>+        (-[WebKitFullScreenListener webkitDidExitFullScreen]): Ditto.
>+        * WebView/WebFullScreenController.mm:
>+        (-[WebFullScreenController enterFullScreen:]): Ditto.
>+        (-[WebFullScreenController finishedEnterFullScreenAnimation:]): Ditto.
>+        (-[WebFullScreenController exitFullScreen]): Ditto.
>+        (-[WebFullScreenController finishedExitFullScreenAnimation:]): Ditto.
>+        * WebView/WebFullScreenController.mm:
>+        (-[WebView _commonInitializationWithFrameName:groupName:]): Pass a reference.
>+
> 2019-01-19  Antoine Quint  <graouts@apple.com>
> 
>         Add a POINTER_EVENTS feature flag
>diff --git a/Source/WebKitLegacy/win/ChangeLog b/Source/WebKitLegacy/win/ChangeLog
>index 3acb67f5c365ded30233dcc3cbde46bbad0b82a1..d454b5297051cacd082340040e20c7e0d68a09c9 100644
>--- a/Source/WebKitLegacy/win/ChangeLog
>+++ b/Source/WebKitLegacy/win/ChangeLog
>@@ -1,3 +1,18 @@
>+2019-01-15  Darin Adler  <darin@apple.com>
>+
>+        Use references rather than pointers for register/unregister functions, and more
>+        https://bugs.webkit.org/show_bug.cgi?id=175028
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * Plugins/PluginView.cpp:
>+        (WebCore::PluginView::startOrAddToUnstartedList): Pass a reference.
>+        (WebCore::PluginView::~PluginView): Ditto.
>+        * WebView.cpp:
>+        (WebView::fullScreenClientWillEnterFullScreen): Ditto.
>+        (WebView::fullScreenClientDidEnterFullScreen): Ditto.
>+        (WebView::fullScreenClientDidExitFullScreen): Ditto.
>+
> 2019-01-17  Per Arne Vollan  <pvollan@apple.com>
> 
>         [Win][HighDPI] Repaint glitches when scrolling.
>diff --git a/Source/WebCore/Modules/applepay/ApplePaySession.cpp b/Source/WebCore/Modules/applepay/ApplePaySession.cpp
>index 74f67ccfbb4ba0371ded4913690fb1969f5510df..06c0fae67f30e6876608b1f73dabc94bc4e66a33 100644
>--- a/Source/WebCore/Modules/applepay/ApplePaySession.cpp
>+++ b/Source/WebCore/Modules/applepay/ApplePaySession.cpp
>@@ -545,7 +545,7 @@ ExceptionOr<void> ApplePaySession::begin()
> 
>     m_state = State::Active;
> 
>-    setPendingActivity(this);
>+    setPendingActivity(*this);
> 
>     return { };
> }
>@@ -652,7 +652,7 @@ ExceptionOr<void> ApplePaySession::completePayment(ApplePayPaymentAuthorizationR
>     }
> 
>     m_state = State::Completed;
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> 
>     return { };
> }
>@@ -1047,7 +1047,7 @@ bool ApplePaySession::isFinalState() const
> void ApplePaySession::didReachFinalState()
> {
>     ASSERT(isFinalState());
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> }
>diff --git a/Source/WebCore/Modules/cache/DOMCache.cpp b/Source/WebCore/Modules/cache/DOMCache.cpp
>index 19ba1948bedba4a8358174df1c848fac0ee0e6fd..41fd62d67ce7ce333067019c49efbd0f061aa7f9 100644
>--- a/Source/WebCore/Modules/cache/DOMCache.cpp
>+++ b/Source/WebCore/Modules/cache/DOMCache.cpp
>@@ -431,7 +431,7 @@ void DOMCache::keys(Optional<RequestInfo>&& info, CacheQueryOptions&& options, K
> 
> void DOMCache::retrieveRecords(const URL& url, WTF::Function<void(Optional<Exception>&&)>&& callback)
> {
>-    setPendingActivity(this);
>+    setPendingActivity(*this);
> 
>     URL retrieveURL = url;
>     retrieveURL.removeQueryAndFragmentIdentifier();
>@@ -447,7 +447,7 @@ void DOMCache::retrieveRecords(const URL& url, WTF::Function<void(Optional<Excep
>                 updateRecords(WTFMove(result.value()));
>             callback(WTF::nullopt);
>         }
>-        unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
>     });
> }
> 
>@@ -484,7 +484,7 @@ Vector<CacheStorageRecord> DOMCache::queryCacheWithTargetStorage(const FetchRequ
> 
> void DOMCache::batchDeleteOperation(const FetchRequest& request, CacheQueryOptions&& options, WTF::Function<void(ExceptionOr<bool>&&)>&& callback)
> {
>-    setPendingActivity(this);
>+    setPendingActivity(*this);
>     m_connection->batchDeleteOperation(m_identifier, request.internalRequest(), WTFMove(options), [this, callback = WTFMove(callback)](RecordIdentifiersOrError&& result) {
>         if (!m_isStopped) {
>             if (!result.has_value())
>@@ -492,7 +492,7 @@ void DOMCache::batchDeleteOperation(const FetchRequest& request, CacheQueryOptio
>             else
>                 callback(!result.value().isEmpty());
>         }
>-        unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
>     });
> }
> 
>@@ -527,7 +527,7 @@ void DOMCache::batchPutOperation(const FetchRequest& request, FetchResponse& res
> 
> void DOMCache::batchPutOperation(Vector<Record>&& records, WTF::Function<void(ExceptionOr<void>&&)>&& callback)
> {
>-    setPendingActivity(this);
>+    setPendingActivity(*this);
>     m_connection->batchPutOperation(m_identifier, WTFMove(records), [this, callback = WTFMove(callback)](RecordIdentifiersOrError&& result) {
>         if (!m_isStopped) {
>             if (!result.has_value())
>@@ -535,7 +535,7 @@ void DOMCache::batchPutOperation(Vector<Record>&& records, WTF::Function<void(Ex
>             else
>                 callback({ });
>         }
>-        unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
>     });
> }
> 
>diff --git a/Source/WebCore/Modules/cache/DOMCacheStorage.cpp b/Source/WebCore/Modules/cache/DOMCacheStorage.cpp
>index 87062d12b7111bb678734fba2401d2f5d672b301..359918d3d10df2af969f015d11a79eaad8fdcd5c 100644
>--- a/Source/WebCore/Modules/cache/DOMCacheStorage.cpp
>+++ b/Source/WebCore/Modules/cache/DOMCacheStorage.cpp
>@@ -101,7 +101,7 @@ void DOMCacheStorage::match(DOMCache::RequestInfo&& info, CacheQueryOptions&& op
>             return;
>         }
> 
>-        setPendingActivity(this);
>+        setPendingActivity(*this);
>         startSequentialMatch(WTF::map(m_caches, copyCache), WTFMove(info), WTFMove(options), [this, promise = WTFMove(promise)](ExceptionOr<FetchResponse*>&& result) mutable {
>             if (!m_isStopped) {
>                 if (result.hasException()) {
>@@ -113,7 +113,7 @@ void DOMCacheStorage::match(DOMCache::RequestInfo&& info, CacheQueryOptions&& op
>                 else
>                     promise->resolve<IDLInterface<FetchResponse>>(*result.returnValue());
>             }
>-            unsetPendingActivity(this);
>+            unsetPendingActivity(*this);
>         });
>     });
> }
>diff --git a/Source/WebCore/Modules/fetch/FetchBodyOwner.cpp b/Source/WebCore/Modules/fetch/FetchBodyOwner.cpp
>index 017a4f519b85226144a2d50b2be45e8fc4d62044..e9326363d70515211b34b2dc19d2697377b2d92f 100644
>--- a/Source/WebCore/Modules/fetch/FetchBodyOwner.cpp
>+++ b/Source/WebCore/Modules/fetch/FetchBodyOwner.cpp
>@@ -248,7 +248,7 @@ void FetchBodyOwner::loadBlob(const Blob& blob, FetchBodyConsumer* consumer)
>         m_blobLoader = WTF::nullopt;
>         return;
>     }
>-    setPendingActivity(this);
>+    setPendingActivity(*this);
> }
> 
> void FetchBodyOwner::finishBlobLoading()
>@@ -256,7 +256,7 @@ void FetchBodyOwner::finishBlobLoading()
>     ASSERT(m_blobLoader);
> 
>     m_blobLoader = WTF::nullopt;
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> void FetchBodyOwner::blobLoadingSucceeded()
>diff --git a/Source/WebCore/Modules/fetch/FetchBodySource.cpp b/Source/WebCore/Modules/fetch/FetchBodySource.cpp
>index 6699ef4e44528548ebfa0ca4416f8cd5958c2295..a8a2a417a1275aa81a154eb857375ca5396f22f6 100644
>--- a/Source/WebCore/Modules/fetch/FetchBodySource.cpp
>+++ b/Source/WebCore/Modules/fetch/FetchBodySource.cpp
>@@ -42,14 +42,14 @@ void FetchBodySource::setActive()
> {
>     ASSERT(m_bodyOwner);
>     if (m_bodyOwner)
>-        m_bodyOwner->setPendingActivity(m_bodyOwner);
>+        m_bodyOwner->setPendingActivity(*m_bodyOwner);
> }
> 
> void FetchBodySource::setInactive()
> {
>     ASSERT(m_bodyOwner);
>     if (m_bodyOwner)
>-        m_bodyOwner->unsetPendingActivity(m_bodyOwner);
>+        m_bodyOwner->unsetPendingActivity(*m_bodyOwner);
> }
> 
> void FetchBodySource::doStart()
>diff --git a/Source/WebCore/Modules/fetch/FetchResponse.cpp b/Source/WebCore/Modules/fetch/FetchResponse.cpp
>index 33d9a340e3580b16366be9bcfc2ed57e6f1161f3..e2a45a4e3347b279e5156677dcf2867d4c6de4db 100644
>--- a/Source/WebCore/Modules/fetch/FetchResponse.cpp
>+++ b/Source/WebCore/Modules/fetch/FetchResponse.cpp
>@@ -314,12 +314,12 @@ FetchResponse::BodyLoader::BodyLoader(FetchResponse& response, NotificationCallb
>     : m_response(response)
>     , m_responseCallback(WTFMove(responseCallback))
> {
>-    m_response.setPendingActivity(&m_response);
>+    m_response.setPendingActivity(m_response);
> }
> 
> FetchResponse::BodyLoader::~BodyLoader()
> {
>-    m_response.unsetPendingActivity(&m_response);
>+    m_response.unsetPendingActivity(m_response);
> }
> 
> static uint64_t nextOpaqueLoadIdentifier { 0 };
>diff --git a/Source/WebCore/Modules/mediasource/MediaSource.cpp b/Source/WebCore/Modules/mediasource/MediaSource.cpp
>index 55399463714f1397e5bb946cf2d4242a4e6b9688..3986198992ae3ed5011972e10915a2f5c8285f19 100644
>--- a/Source/WebCore/Modules/mediasource/MediaSource.cpp
>+++ b/Source/WebCore/Modules/mediasource/MediaSource.cpp
>@@ -133,12 +133,12 @@ void MediaSource::setPrivateAndOpen(Ref<MediaSourcePrivate>&& mediaSourcePrivate
> 
> void MediaSource::addedToRegistry()
> {
>-    setPendingActivity(this);
>+    setPendingActivity(*this);
> }
> 
> void MediaSource::removedFromRegistry()
> {
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> MediaTime MediaSource::duration() const
>diff --git a/Source/WebCore/Modules/mediastream/MediaStream.cpp b/Source/WebCore/Modules/mediastream/MediaStream.cpp
>index 8ac1457950a79189d3acd2d070566a2187bcfae1..18f2587e6bbde4eb6ac7ae37b10c7045900fe229 100644
>--- a/Source/WebCore/Modules/mediastream/MediaStream.cpp
>+++ b/Source/WebCore/Modules/mediastream/MediaStream.cpp
>@@ -123,7 +123,7 @@ MediaStream::~MediaStream()
>         track->removeObserver(*this);
>     if (Document* document = this->document()) {
>         if (m_isWaitingUntilMediaCanStart)
>-            document->removeMediaCanStartListener(this);
>+            document->removeMediaCanStartListener(*this);
>     }
> }
> 
>@@ -282,7 +282,7 @@ void MediaStream::startProducingData()
>             return;
> 
>         m_isWaitingUntilMediaCanStart = true;
>-        document->addMediaCanStartListener(this);
>+        document->addMediaCanStartListener(*this);
>         return;
>     }
> 
>diff --git a/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp b/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
>index d83c5b74e1021daf10dca4460573fc18ca4d1ea4..506c145963803a2ceeb8af82bc2a175d3bb5429d 100644
>--- a/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
>+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
>@@ -61,7 +61,7 @@ MediaStreamTrack::MediaStreamTrack(ScriptExecutionContext& context, Ref<MediaStr
>     m_private->addObserver(*this);
> 
>     if (auto document = this->document())
>-        document->addAudioProducer(this);
>+        document->addAudioProducer(*this);
> }
> 
> MediaStreamTrack::~MediaStreamTrack()
>@@ -69,7 +69,7 @@ MediaStreamTrack::~MediaStreamTrack()
>     m_private->removeObserver(*this);
> 
>     if (auto document = this->document())
>-        document->removeAudioProducer(this);
>+        document->removeAudioProducer(*this);
> }
> 
> const AtomicString& MediaStreamTrack::kind() const
>diff --git a/Source/WebCore/Modules/mediastream/RTCDataChannel.cpp b/Source/WebCore/Modules/mediastream/RTCDataChannel.cpp
>index 90d1c8ac1b384e7ebb8091ea45779eae0242bb0c..e027bb593199ad90ab4bf32a1e8968f4c454a504 100644
>--- a/Source/WebCore/Modules/mediastream/RTCDataChannel.cpp
>+++ b/Source/WebCore/Modules/mediastream/RTCDataChannel.cpp
>@@ -58,7 +58,7 @@ Ref<RTCDataChannel> RTCDataChannel::create(ScriptExecutionContext& context, std:
>     auto channel = adoptRef(*new RTCDataChannel(context, WTFMove(handler), WTFMove(label), WTFMove(options)));
>     channel->suspendIfNeeded();
>     channel->m_handler->setClient(channel.get());
>-    channel->setPendingActivity(channel.ptr());
>+    channel->setPendingActivity(channel.get());
>     return channel;
> }
> 
>@@ -159,7 +159,7 @@ void RTCDataChannel::close()
> 
>     m_handler->close();
>     m_handler = nullptr;
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> void RTCDataChannel::didChangeReadyState(RTCDataChannelState newState)
>diff --git a/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp b/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
>index 4e4f06c81422a129a4f2d3788a5a977578005486..338dc1a9a40d8124da68bd40ead4e9039a4e723e 100644
>--- a/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
>+++ b/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
>@@ -64,7 +64,7 @@ using namespace PeerConnection;
> 
> Ref<RTCPeerConnection> RTCPeerConnection::create(ScriptExecutionContext& context)
> {
>-    Ref<RTCPeerConnection> peerConnection = adoptRef(*new RTCPeerConnection(context));
>+    auto peerConnection = adoptRef(*new RTCPeerConnection(context));
>     peerConnection->suspendIfNeeded();
>     // RTCPeerConnection may send events at about any time during its lifetime.
>     // Let's make it uncollectable until the pc is closed by JS or the page stops it.
>diff --git a/Source/WebCore/Modules/notifications/Notification.cpp b/Source/WebCore/Modules/notifications/Notification.cpp
>index 1958db21cbf9b1e86e2216372e9ab40b76f3ff53..cc6aae29e98c82d5c3d535ee5169b2578bda1892 100644
>--- a/Source/WebCore/Modules/notifications/Notification.cpp
>+++ b/Source/WebCore/Modules/notifications/Notification.cpp
>@@ -91,7 +91,7 @@ void Notification::show()
>     }
>     if (client.show(this)) {
>         m_state = Showing;
>-        setPendingActivity(this);
>+        setPendingActivity(*this);
>     }
> }
> 
>@@ -136,7 +136,7 @@ void Notification::finalize()
>     if (m_state == Closed)
>         return;
>     m_state = Closed;
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> void Notification::dispatchShowEvent()
>diff --git a/Source/WebCore/Modules/webaudio/AudioBasicInspectorNode.cpp b/Source/WebCore/Modules/webaudio/AudioBasicInspectorNode.cpp
>index 27e56c4c6b947aeb82459ed13f33b581a3d3a0a4..055bff5f1ebaa1b2be5a7c440ee09f3b178b9c1f 100644
>--- a/Source/WebCore/Modules/webaudio/AudioBasicInspectorNode.cpp
>+++ b/Source/WebCore/Modules/webaudio/AudioBasicInspectorNode.cpp
>@@ -99,7 +99,7 @@ void AudioBasicInspectorNode::updatePullStatus()
>         // When an AudioBasicInspectorNode is connected to a downstream node, it will get pulled by the
>         // downstream node, thus remove it from the context's automatic pull list.
>         if (m_needAutomaticPull) {
>-            context().removeAutomaticPullNode(this);
>+            context().removeAutomaticPullNode(*this);
>             m_needAutomaticPull = false;
>         }
>     } else {
>@@ -107,11 +107,11 @@ void AudioBasicInspectorNode::updatePullStatus()
>         if (numberOfInputConnections && !m_needAutomaticPull) {
>             // When an AudioBasicInspectorNode is not connected to any downstream node while still connected from
>             // upstream node(s), add it to the context's automatic pull list.
>-            context().addAutomaticPullNode(this);
>+            context().addAutomaticPullNode(*this);
>             m_needAutomaticPull = true;
>         } else if (!numberOfInputConnections && m_needAutomaticPull) {
>             // The AudioBasicInspectorNode is connected to nothing, remove it from the context's automatic pull list.
>-            context().removeAutomaticPullNode(this);
>+            context().removeAutomaticPullNode(*this);
>             m_needAutomaticPull = false;
>         }
>     }
>diff --git a/Source/WebCore/Modules/webaudio/AudioContext.cpp b/Source/WebCore/Modules/webaudio/AudioContext.cpp
>index d940dc0f7b59a11841e115306860ecbd832017b0..d8df3f50a9186548aea67ca0a7e83bd59d223833 100644
>--- a/Source/WebCore/Modules/webaudio/AudioContext.cpp
>+++ b/Source/WebCore/Modules/webaudio/AudioContext.cpp
>@@ -160,7 +160,7 @@ void AudioContext::constructCommon()
> {
>     // According to spec AudioContext must die only after page navigate.
>     // Lets mark it as ActiveDOMObject with pending activity and unmark it in clear method.
>-    setPendingActivity(this);
>+    setPendingActivity(*this);
> 
>     FFTFrame::initialize();
>     
>@@ -207,8 +207,8 @@ void AudioContext::lazyInitialize()
>         m_destinationNode->initialize();
> 
>         if (!isOfflineContext()) {
>-            document()->addAudioProducer(this);
>-            document()->registerForVisibilityStateChangedCallbacks(this);
>+            document()->addAudioProducer(*this);
>+            document()->registerForVisibilityStateChangedCallbacks(*this);
> 
>             // This starts the audio thread. The destination node's provideInput() method will now be called repeatedly to render audio.
>             // Each time provideInput() is called, a portion of the audio stream is rendered. Let's call this time period a "render quantum".
>@@ -235,7 +235,7 @@ void AudioContext::clear()
>     } while (m_nodesToDelete.size());
> 
>     // It was set in constructCommon.
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> void AudioContext::uninitialize()
>@@ -252,8 +252,8 @@ void AudioContext::uninitialize()
>     m_isAudioThreadFinished = true;
> 
>     if (!isOfflineContext()) {
>-        document()->removeAudioProducer(this);
>-        document()->unregisterForVisibilityStateChangedCallbacks(this);
>+        document()->removeAudioProducer(*this);
>+        document()->unregisterForVisibilityStateChangedCallbacks(*this);
> 
>         ASSERT(s_hardwareContextCount);
>         --s_hardwareContextCount;
>@@ -816,14 +816,14 @@ void AudioContext::handleDeferredFinishDerefs()
>     m_deferredFinishDerefList.clear();
> }
> 
>-void AudioContext::markForDeletion(AudioNode* node)
>+void AudioContext::markForDeletion(AudioNode& node)
> {
>     ASSERT(isGraphOwner());
> 
>     if (isAudioThreadFinished())
>-        m_nodesToDelete.append(node);
>+        m_nodesToDelete.append(&node);
>     else
>-        m_nodesMarkedForDeletion.append(node);
>+        m_nodesMarkedForDeletion.append(&node);
> 
>     // This is probably the best time for us to remove the node from automatic pull list,
>     // since all connections are gone and we hold the graph lock. Then when handlePostRenderTasks()
>@@ -920,19 +920,19 @@ void AudioContext::handleDirtyAudioNodeOutputs()
>     m_dirtyAudioNodeOutputs.clear();
> }
> 
>-void AudioContext::addAutomaticPullNode(AudioNode* node)
>+void AudioContext::addAutomaticPullNode(AudioNode& node)
> {
>     ASSERT(isGraphOwner());
> 
>-    if (m_automaticPullNodes.add(node).isNewEntry)
>+    if (m_automaticPullNodes.add(&node).isNewEntry)
>         m_automaticPullNodesNeedUpdating = true;
> }
> 
>-void AudioContext::removeAutomaticPullNode(AudioNode* node)
>+void AudioContext::removeAutomaticPullNode(AudioNode& node)
> {
>     ASSERT(isGraphOwner());
> 
>-    if (m_automaticPullNodes.remove(node))
>+    if (m_automaticPullNodes.remove(&node))
>         m_automaticPullNodesNeedUpdating = true;
> }
> 
>@@ -989,7 +989,7 @@ bool AudioContext::willBeginPlayback()
>     if (pageConsentRequiredForAudioStart()) {
>         Page* page = document()->page();
>         if (page && !page->canStartMedia()) {
>-            document()->addMediaCanStartListener(this);
>+            document()->addMediaCanStartListener(*this);
>             return false;
>         }
>         removeBehaviorRestriction(AudioContext::RequirePageConsentForAudioStartRestriction);
>@@ -1009,7 +1009,7 @@ bool AudioContext::willPausePlayback()
>     if (pageConsentRequiredForAudioStart()) {
>         Page* page = document()->page();
>         if (page && !page->canStartMedia()) {
>-            document()->addMediaCanStartListener(this);
>+            document()->addMediaCanStartListener(*this);
>             return false;
>         }
>         removeBehaviorRestriction(AudioContext::RequirePageConsentForAudioStartRestriction);
>diff --git a/Source/WebCore/Modules/webaudio/AudioContext.h b/Source/WebCore/Modules/webaudio/AudioContext.h
>index 4ef0b4dde01754fd7bd68922a455d9367ecb86d2..49d35661188a2d4cfb3505eb8dbc1cfed2592601 100644
>--- a/Source/WebCore/Modules/webaudio/AudioContext.h
>+++ b/Source/WebCore/Modules/webaudio/AudioContext.h
>@@ -156,13 +156,13 @@ public:
>     void derefFinishedSourceNodes();
> 
>     // We schedule deletion of all marked nodes at the end of each realtime render quantum.
>-    void markForDeletion(AudioNode*);
>+    void markForDeletion(AudioNode&);
>     void deleteMarkedNodes();
> 
>     // AudioContext can pull node(s) at the end of each render quantum even when they are not connected to any downstream nodes.
>     // These two methods are called by the nodes who want to add/remove themselves into/from the automatic pull lists.
>-    void addAutomaticPullNode(AudioNode*);
>-    void removeAutomaticPullNode(AudioNode*);
>+    void addAutomaticPullNode(AudioNode&);
>+    void removeAutomaticPullNode(AudioNode&);
> 
>     // Called right before handlePostRenderTasks() to handle nodes which need to be pulled even when they are not connected to anything.
>     void processAutomaticPullNodes(size_t framesToProcess);
>diff --git a/Source/WebCore/Modules/webaudio/AudioNode.cpp b/Source/WebCore/Modules/webaudio/AudioNode.cpp
>index ad1351f44aeef347c3edb0d5da5be17113e797fa..6139fdd85b167a3702a161e0ff240f6c2a01d89b 100644
>--- a/Source/WebCore/Modules/webaudio/AudioNode.cpp
>+++ b/Source/WebCore/Modules/webaudio/AudioNode.cpp
>@@ -477,7 +477,7 @@ void AudioNode::finishDeref(RefType refType)
>                     output->disconnectAll(); // This will deref() nodes we're connected to.
> 
>                 // Mark for deletion at end of each render quantum or when context shuts down.
>-                context().markForDeletion(this);
>+                context().markForDeletion(*this);
>                 m_isMarkedForDeletion = true;
>             }
>         } else if (refType == RefTypeConnection)
>diff --git a/Source/WebCore/Modules/websockets/WebSocket.cpp b/Source/WebCore/Modules/websockets/WebSocket.cpp
>index 26d38ff1b6d23126c8dd76eb7d56aa55441f8e30..5027db6f3530f71abc6386913779e18826cbc1c8 100644
>--- a/Source/WebCore/Modules/websockets/WebSocket.cpp
>+++ b/Source/WebCore/Modules/websockets/WebSocket.cpp
>@@ -287,8 +287,8 @@ ExceptionOr<void> WebSocket::connect(const String& url, const Vector<String>& pr
>         Document& document = downcast<Document>(context);
>         RefPtr<Frame> frame = document.frame();
>         if (!frame || !frame->loader().mixedContentChecker().canRunInsecureContent(document.securityOrigin(), m_url)) {
>-            // Balanced by the call to ActiveDOMObject::unsetPendingActivity() in WebSocket::stop().
>-            ActiveDOMObject::setPendingActivity(this);
>+            // Balanced by the call to unsetPendingActivity() in WebSocket::stop().
>+            setPendingActivity(*this);
> 
>             // We must block this connection. Instead of throwing an exception, we indicate this
>             // using the error event. But since this code executes as part of the WebSocket's
>@@ -318,7 +318,7 @@ ExceptionOr<void> WebSocket::connect(const String& url, const Vector<String>& pr
>         protocolString = joinStrings(protocols, subprotocolSeparator());
> 
>     m_channel->connect(m_url, protocolString);
>-    ActiveDOMObject::setPendingActivity(this);
>+    setPendingActivity(*this);
> 
>     return { };
> }
>@@ -547,7 +547,7 @@ void WebSocket::stop()
>     m_pendingEvents.clear();
>     ActiveDOMObject::stop();
>     if (pending)
>-        ActiveDOMObject::unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
> }
> 
> const char* WebSocket::activeDOMObjectName() const
>@@ -631,7 +631,7 @@ void WebSocket::didClose(unsigned unhandledBufferedAmount, ClosingHandshakeCompl
>         m_channel = nullptr;
>     }
>     if (hasPendingActivity())
>-        ActiveDOMObject::unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
> }
> 
> void WebSocket::didUpgradeURL()
>diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
>index 6fedc2224f8b15f25d01338710a06961f63564d8..25f7ddb58c535c2cdbf183de44fb4d80764c3af6 100644
>--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
>+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
>@@ -16952,12 +16952,12 @@
> 			isa = PBXGroup;
> 			children = (
> 				A584FE2518637DAB00843B10 /* CommandLineAPIModuleSource.h */,
>+				9175CE5921E281EC00DF2C28 /* InspectorAuditAccessibilityObject.cpp */,
>+				9175CE5A21E281ED00DF2C28 /* InspectorAuditAccessibilityObject.h */,
>+				9175CE5721E281EB00DF2C28 /* InspectorAuditDOMObject.cpp */,
>+				9175CE5821E281EC00DF2C28 /* InspectorAuditDOMObject.h */,
> 				A584FE391864E2D800843B10 /* JSCommandLineAPIHost.cpp */,
> 				A584FE3A1864E2D800843B10 /* JSCommandLineAPIHost.h */,
>-				9175CE5921E281EC00DF2C28 /* JSInspectorAuditAccessibilityObject.cpp */,
>-				9175CE5A21E281ED00DF2C28 /* JSInspectorAuditAccessibilityObject.h */,
>-				9175CE5721E281EB00DF2C28 /* JSInspectorAuditDOMObject.cpp */,
>-				9175CE5821E281EC00DF2C28 /* JSInspectorAuditDOMObject.h */,
> 				7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */,
> 				7A0E771D10C00DB100A0276E /* JSInspectorFrontendHost.h */,
> 			);
>@@ -29579,7 +29579,9 @@
> 				93309DF2099E64920056E581 /* InsertTextCommand.h in Headers */,
> 				A5B81CA71FAA44620037D1E6 /* InspectorApplicationCacheAgent.h in Headers */,
> 				9175CE5E21E281ED00DF2C27 /* InspectorAuditAccessibilityObject.h in Headers */,
>+				9175CE5E21E281ED00DF2C28 /* InspectorAuditAccessibilityObject.h in Headers */,
> 				9175CE5C21E281ED00DF2C27 /* InspectorAuditDOMObject.h in Headers */,
>+				9175CE5C21E281ED00DF2C28 /* InspectorAuditDOMObject.h in Headers */,
> 				6A22E8701F10418600F546C3 /* InspectorCanvas.h in Headers */,
> 				A5B81CA81FAA44620037D1E6 /* InspectorCanvasAgent.h in Headers */,
> 				1C81B95C0E97330800266E07 /* InspectorClient.h in Headers */,
>@@ -30012,8 +30014,6 @@
> 				A77979290D6B9E64003851B9 /* JSImageData.h in Headers */,
> 				7C193C011F5E11050088F3E6 /* JSImageSmoothingQuality.h in Headers */,
> 				A86629D309DA2B48009633A6 /* JSInputEvent.h in Headers */,
>-				9175CE5E21E281ED00DF2C28 /* JSInspectorAuditAccessibilityObject.h in Headers */,
>-				9175CE5C21E281ED00DF2C28 /* JSInspectorAuditDOMObject.h in Headers */,
> 				7A0E771F10C00DB100A0276E /* JSInspectorFrontendHost.h in Headers */,
> 				0F4710E61DB700C7002DCEC3 /* JSIntersectionObserver.h in Headers */,
> 				0F8B45761DC41DBA00443C3F /* JSIntersectionObserverCallback.h in Headers */,
>@@ -32445,6 +32445,7 @@
> 				Spanish,
> 				Dutch,
> 				Italian,
>+				en,
> 			);
> 			mainGroup = 0867D691FE84028FC02AAC07 /* WebCore */;
> 			productRefGroup = 034768DFFF38A50411DB9C8B /* Products */;
>diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
>index c74334e8a74632ff7e6657dd2da9f4106586b5e3..f48234a72c52ec1adb74e37364e7ec9e6042d1e4 100644
>--- a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
>+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
>@@ -306,7 +306,7 @@ JSC::Identifier JSDOMWindowBase::moduleLoaderResolve(JSC::JSGlobalObject* global
> {
>     JSDOMWindowBase* thisObject = JSC::jsCast<JSDOMWindowBase*>(globalObject);
>     if (RefPtr<Document> document = thisObject->wrapped().document())
>-        return document->moduleLoader()->resolve(globalObject, exec, moduleLoader, moduleName, importerModuleKey, scriptFetcher);
>+        return document->moduleLoader().resolve(globalObject, exec, moduleLoader, moduleName, importerModuleKey, scriptFetcher);
>     return { };
> }
> 
>@@ -316,7 +316,7 @@ JSC::JSInternalPromise* JSDOMWindowBase::moduleLoaderFetch(JSC::JSGlobalObject*
>     auto scope = DECLARE_THROW_SCOPE(vm);
>     JSDOMWindowBase* thisObject = JSC::jsCast<JSDOMWindowBase*>(globalObject);
>     if (RefPtr<Document> document = thisObject->wrapped().document())
>-        RELEASE_AND_RETURN(scope, document->moduleLoader()->fetch(globalObject, exec, moduleLoader, moduleKey, parameters, scriptFetcher));
>+        RELEASE_AND_RETURN(scope, document->moduleLoader().fetch(globalObject, exec, moduleLoader, moduleKey, parameters, scriptFetcher));
>     JSC::JSInternalPromiseDeferred* deferred = JSC::JSInternalPromiseDeferred::tryCreate(exec, globalObject);
>     RETURN_IF_EXCEPTION(scope, nullptr);
>     RELEASE_AND_RETURN(scope, deferred->reject(exec, jsUndefined()));
>@@ -326,7 +326,7 @@ JSC::JSValue JSDOMWindowBase::moduleLoaderEvaluate(JSC::JSGlobalObject* globalOb
> {
>     JSDOMWindowBase* thisObject = JSC::jsCast<JSDOMWindowBase*>(globalObject);
>     if (RefPtr<Document> document = thisObject->wrapped().document())
>-        return document->moduleLoader()->evaluate(globalObject, exec, moduleLoader, moduleKey, moduleRecord, scriptFetcher);
>+        return document->moduleLoader().evaluate(globalObject, exec, moduleLoader, moduleKey, moduleRecord, scriptFetcher);
>     return JSC::jsUndefined();
> }
> 
>@@ -336,7 +336,7 @@ JSC::JSInternalPromise* JSDOMWindowBase::moduleLoaderImportModule(JSC::JSGlobalO
>     auto scope = DECLARE_THROW_SCOPE(vm);
>     JSDOMWindowBase* thisObject = JSC::jsCast<JSDOMWindowBase*>(globalObject);
>     if (RefPtr<Document> document = thisObject->wrapped().document())
>-        RELEASE_AND_RETURN(scope, document->moduleLoader()->importModule(globalObject, exec, moduleLoader, moduleName, parameters, sourceOrigin));
>+        RELEASE_AND_RETURN(scope, document->moduleLoader().importModule(globalObject, exec, moduleLoader, moduleName, parameters, sourceOrigin));
>     JSC::JSInternalPromiseDeferred* deferred = JSC::JSInternalPromiseDeferred::tryCreate(exec, globalObject);
>     RETURN_IF_EXCEPTION(scope, nullptr);
>     RELEASE_AND_RETURN(scope, deferred->reject(exec, jsUndefined()));
>@@ -346,7 +346,7 @@ JSC::JSObject* JSDOMWindowBase::moduleLoaderCreateImportMetaProperties(JSC::JSGl
> {
>     JSDOMWindowBase* thisObject = JSC::jsCast<JSDOMWindowBase*>(globalObject);
>     if (RefPtr<Document> document = thisObject->wrapped().document())
>-        return document->moduleLoader()->createImportMetaProperties(globalObject, exec, moduleLoader, moduleKey, moduleRecord, scriptFetcher);
>+        return document->moduleLoader().createImportMetaProperties(globalObject, exec, moduleLoader, moduleKey, moduleRecord, scriptFetcher);
>     return constructEmptyObject(exec, globalObject->nullPrototypeObjectStructure());
> }
> 
>diff --git a/Source/WebCore/dom/ActiveDOMObject.h b/Source/WebCore/dom/ActiveDOMObject.h
>index 360ad21489adbd5fecbb817680df4b9e8f789e74..ebdf586140d28e4a8678859ca9a0072c9db0e13a 100644
>--- a/Source/WebCore/dom/ActiveDOMObject.h
>+++ b/Source/WebCore/dom/ActiveDOMObject.h
>@@ -71,18 +71,18 @@ public:
>     // It can, however, have a side effect of deleting an ActiveDOMObject.
>     virtual void stop();
> 
>-    template<class T> void setPendingActivity(T* thisObject)
>+    template<typename T> void setPendingActivity(T& thisObject)
>     {
>-        ASSERT(thisObject == this);
>-        thisObject->ref();
>+        ASSERT(&thisObject == this);
>+        thisObject.ref();
>         ++m_pendingActivityCount;
>     }
> 
>-    template<class T> void unsetPendingActivity(T* thisObject)
>+    template<typename T> void unsetPendingActivity(T& thisObject)
>     {
>         ASSERT(m_pendingActivityCount > 0);
>         --m_pendingActivityCount;
>-        thisObject->deref();
>+        thisObject.deref();
>     }
> 
>     template<class T>
>diff --git a/Source/WebCore/dom/CharacterData.cpp b/Source/WebCore/dom/CharacterData.cpp
>index bf4d2277d6b0c2a5ce60d4e5036b099be7187723..dff2ba8fd6290a65dffada779ba01926398f4cf0 100644
>--- a/Source/WebCore/dom/CharacterData.cpp
>+++ b/Source/WebCore/dom/CharacterData.cpp
>@@ -54,7 +54,7 @@ void CharacterData::setData(const String& data)
>     unsigned oldLength = length();
> 
>     if (m_data == nonNullData && canUseSetDataOptimization(*this)) {
>-        document().textRemoved(this, 0, oldLength);
>+        document().textRemoved(*this, 0, oldLength);
>         if (document().frame())
>             document().frame()->selection().textWasReplaced(this, 0, oldLength, oldLength);
>         return;
>@@ -63,7 +63,7 @@ void CharacterData::setData(const String& data)
>     Ref<CharacterData> protectedThis(*this);
> 
>     setDataAndUpdate(nonNullData, 0, oldLength, nonNullData.length());
>-    document().textRemoved(this, 0, oldLength);
>+    document().textRemoved(*this, 0, oldLength);
> }
> 
> ExceptionOr<String> CharacterData::substringData(unsigned offset, unsigned count)
>@@ -135,7 +135,7 @@ ExceptionOr<void> CharacterData::insertData(unsigned offset, const String& data)
> 
>     setDataAndUpdate(newStr, offset, 0, data.length());
> 
>-    document().textInserted(this, offset, data.length());
>+    document().textInserted(*this, offset, data.length());
> 
>     return { };
> }
>@@ -152,7 +152,7 @@ ExceptionOr<void> CharacterData::deleteData(unsigned offset, unsigned count)
> 
>     setDataAndUpdate(newStr, offset, count, 0);
> 
>-    document().textRemoved(this, offset, count);
>+    document().textRemoved(*this, offset, count);
> 
>     return { };
> }
>@@ -171,8 +171,8 @@ ExceptionOr<void> CharacterData::replaceData(unsigned offset, unsigned count, co
>     setDataAndUpdate(newStr, offset, count, data.length());
> 
>     // update the markers for spell checking and grammar checking
>-    document().textRemoved(this, offset, count);
>-    document().textInserted(this, offset, data.length());
>+    document().textRemoved(*this, offset, count);
>+    document().textInserted(*this, offset, data.length());
> 
>     return { };
> }
>diff --git a/Source/WebCore/dom/DeviceMotionClient.h b/Source/WebCore/dom/DeviceMotionClient.h
>index 58d23ed379ca7955a6a7f5b0668937123a065b49..b2999afb731fe3c18f0dd33623922125ec6cfd57 100644
>--- a/Source/WebCore/dom/DeviceMotionClient.h
>+++ b/Source/WebCore/dom/DeviceMotionClient.h
>@@ -45,6 +45,4 @@ public:
>     virtual void deviceMotionControllerDestroyed() = 0;
> };
> 
>-void provideDeviceMotionTo(Page*, DeviceMotionClient*);
>-
> } // namespace WebCore
>diff --git a/Source/WebCore/dom/DeviceMotionController.cpp b/Source/WebCore/dom/DeviceMotionController.cpp
>index ff682ac4ba1c0179346b4f08e0b5e6ce5e0562e1..356084a77f864fec9cf371ed8b146357297c5587 100644
>--- a/Source/WebCore/dom/DeviceMotionController.cpp
>+++ b/Source/WebCore/dom/DeviceMotionController.cpp
>@@ -35,27 +35,28 @@
> 
> namespace WebCore {
> 
>-DeviceMotionController::DeviceMotionController(DeviceMotionClient* client)
>+DeviceMotionController::DeviceMotionController(DeviceMotionClient& client)
>     : DeviceController(client)
> {
>-    ASSERT(m_client);
>-    deviceMotionClient()->setController(this);
>+    deviceMotionClient().setController(this);
> }
> 
> #if PLATFORM(IOS_FAMILY)
>-// FIXME: We should look to reconcile the iOS and OpenSource differences with this class
>-// so that we can either remove these methods or remove the PLATFORM(IOS_FAMILY)-guard.
>+
>+// FIXME: We should look to reconcile the iOS vs. non-iOS differences with this class
>+// so that we can either remove these functions or the PLATFORM(IOS_FAMILY)-guard.
>+
> void DeviceMotionController::suspendUpdates()
> {
>-    if (m_client)
>-        m_client->stopUpdating();
>+    m_client.stopUpdating();
> }
> 
> void DeviceMotionController::resumeUpdates()
> {
>-    if (m_client && !m_listeners.isEmpty())
>-        m_client->startUpdating();
>+    if (!m_listeners.isEmpty())
>+        m_client.startUpdating();
> }
>+
> #endif
>     
> void DeviceMotionController::didChangeDeviceMotion(DeviceMotionData* deviceMotionData)
>@@ -63,19 +64,19 @@ void DeviceMotionController::didChangeDeviceMotion(DeviceMotionData* deviceMotio
>     dispatchDeviceEvent(DeviceMotionEvent::create(eventNames().devicemotionEvent, deviceMotionData));
> }
> 
>-DeviceMotionClient* DeviceMotionController::deviceMotionClient()
>+DeviceMotionClient& DeviceMotionController::deviceMotionClient()
> {
>-    return static_cast<DeviceMotionClient*>(m_client);
>+    return static_cast<DeviceMotionClient&>(m_client);
> }
> 
> bool DeviceMotionController::hasLastData()
> {
>-    return deviceMotionClient()->lastMotion();
>+    return deviceMotionClient().lastMotion();
> }
> 
> RefPtr<Event> DeviceMotionController::getLastEvent()
> {
>-    return DeviceMotionEvent::create(eventNames().devicemotionEvent, deviceMotionClient()->lastMotion());
>+    return DeviceMotionEvent::create(eventNames().devicemotionEvent, deviceMotionClient().lastMotion());
> }
> 
> const char* DeviceMotionController::supplementName()
>@@ -95,9 +96,4 @@ bool DeviceMotionController::isActiveAt(Page* page)
>     return false;
> }
> 
>-void provideDeviceMotionTo(Page* page, DeviceMotionClient* client)
>-{
>-    DeviceMotionController::provideTo(page, DeviceMotionController::supplementName(), std::make_unique<DeviceMotionController>(client));
>-}
>-
> } // namespace WebCore
>diff --git a/Source/WebCore/dom/DeviceMotionController.h b/Source/WebCore/dom/DeviceMotionController.h
>index ff805c6660e35c14f04b807d3f6f736830a544a8..3f625aa67c16d298e67082234cabebc07f8d1d82 100644
>--- a/Source/WebCore/dom/DeviceMotionController.h
>+++ b/Source/WebCore/dom/DeviceMotionController.h
>@@ -37,7 +37,7 @@ class DeviceMotionData;
> class DeviceMotionController final : public DeviceController {
>     WTF_MAKE_NONCOPYABLE(DeviceMotionController);
> public:
>-    explicit DeviceMotionController(DeviceMotionClient*);
>+    explicit DeviceMotionController(DeviceMotionClient&);
>     virtual ~DeviceMotionController() = default;
> 
> #if PLATFORM(IOS_FAMILY)
>@@ -48,7 +48,7 @@ public:
> #endif
> 
>     void didChangeDeviceMotion(DeviceMotionData*);
>-    DeviceMotionClient* deviceMotionClient();
>+    DeviceMotionClient& deviceMotionClient();
> 
>     bool hasLastData() override;
>     RefPtr<Event> getLastEvent() override;
>diff --git a/Source/WebCore/dom/DeviceOrientationClient.h b/Source/WebCore/dom/DeviceOrientationClient.h
>index 5ca701372948e512399035d2753a3bb35c4b34f4..67ee4c974ea18b87c67a760b7f0f653ed1abb852 100644
>--- a/Source/WebCore/dom/DeviceOrientationClient.h
>+++ b/Source/WebCore/dom/DeviceOrientationClient.h
>@@ -45,6 +45,6 @@ public:
>     virtual void deviceOrientationControllerDestroyed() = 0;
> };
> 
>-WEBCORE_EXPORT void provideDeviceOrientationTo(Page*, DeviceOrientationClient*);
>+WEBCORE_EXPORT void provideDeviceOrientationTo(Page&, DeviceOrientationClient&);
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/dom/DeviceOrientationController.cpp b/Source/WebCore/dom/DeviceOrientationController.cpp
>index 142541656a36718be38cf72616c66922c7805c6b..3362231081b13f72dc18dac5f3907a5e7c17b0bf 100644
>--- a/Source/WebCore/dom/DeviceOrientationController.cpp
>+++ b/Source/WebCore/dom/DeviceOrientationController.cpp
>@@ -35,19 +35,10 @@
> 
> namespace WebCore {
> 
>-DeviceOrientationController::DeviceOrientationController(DeviceOrientationClient* client)
>+DeviceOrientationController::DeviceOrientationController(DeviceOrientationClient& client)
>     : DeviceController(client)
> {
>-#if PLATFORM(IOS_FAMILY)
>-    // FIXME: Temporarily avoid asserting while OpenSource is using a different design.
>-    // We should reconcile the differences between OpenSource and iOS so that we can
>-    // remove this code path.
>-    if (m_client)
>-        deviceOrientationClient()->setController(this);
>-#else
>-    ASSERT(m_client);
>-    deviceOrientationClient()->setController(this);
>-#endif
>+    deviceOrientationClient().setController(this);
> }
> 
> void DeviceOrientationController::didChangeDeviceOrientation(DeviceOrientationData* orientation)
>@@ -55,35 +46,39 @@ void DeviceOrientationController::didChangeDeviceOrientation(DeviceOrientationDa
>     dispatchDeviceEvent(DeviceOrientationEvent::create(eventNames().deviceorientationEvent, orientation));
> }
> 
>-DeviceOrientationClient* DeviceOrientationController::deviceOrientationClient()
>+DeviceOrientationClient& DeviceOrientationController::deviceOrientationClient()
> {
>-    return static_cast<DeviceOrientationClient*>(m_client);
>+    return static_cast<DeviceOrientationClient&>(m_client);
> }
> 
> #if PLATFORM(IOS_FAMILY)
>-// FIXME: We should look to reconcile the iOS and OpenSource differences with this class
>-// so that we can either remove these methods or remove the PLATFORM(IOS_FAMILY)-guard.
>+
>+// FIXME: We should look to reconcile the iOS and non-iOS differences with this class
>+// so that we can either remove these functions or remove the PLATFORM(IOS_FAMILY)-guard.
>+
> void DeviceOrientationController::suspendUpdates()
> {
>-    if (m_client)
>-        m_client->stopUpdating();
>+    m_client.stopUpdating();
> }
> 
> void DeviceOrientationController::resumeUpdates()
> {
>-    if (m_client && !m_listeners.isEmpty())
>-        m_client->startUpdating();
>+    if (!m_listeners.isEmpty())
>+        m_client.startUpdating();
> }
>+
> #else
>+
> bool DeviceOrientationController::hasLastData()
> {
>-    return deviceOrientationClient()->lastOrientation();
>+    return deviceOrientationClient().lastOrientation();
> }
> 
> RefPtr<Event> DeviceOrientationController::getLastEvent()
> {
>-    return DeviceOrientationEvent::create(eventNames().deviceorientationEvent, deviceOrientationClient()->lastOrientation());
>+    return DeviceOrientationEvent::create(eventNames().deviceorientationEvent, deviceOrientationClient().lastOrientation());
> }
>+
> #endif // PLATFORM(IOS_FAMILY)
> 
> const char* DeviceOrientationController::supplementName()
>@@ -103,9 +98,9 @@ bool DeviceOrientationController::isActiveAt(Page* page)
>     return false;
> }
> 
>-void provideDeviceOrientationTo(Page* page, DeviceOrientationClient* client)
>+void provideDeviceOrientationTo(Page& page, DeviceOrientationClient& client)
> {
>-    DeviceOrientationController::provideTo(page, DeviceOrientationController::supplementName(), std::make_unique<DeviceOrientationController>(client));
>+    DeviceOrientationController::provideTo(&page, DeviceOrientationController::supplementName(), std::make_unique<DeviceOrientationController>(client));
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/dom/DeviceOrientationController.h b/Source/WebCore/dom/DeviceOrientationController.h
>index 56dcb85f45541c13b78d9b797d919dd80f841da1..f52d71e08a8217ef2935a901750527cb7b950fac 100644
>--- a/Source/WebCore/dom/DeviceOrientationController.h
>+++ b/Source/WebCore/dom/DeviceOrientationController.h
>@@ -38,11 +38,11 @@ class Page;
> class DeviceOrientationController final : public DeviceController {
>     WTF_MAKE_NONCOPYABLE(DeviceOrientationController);
> public:
>-    explicit DeviceOrientationController(DeviceOrientationClient*);
>+    explicit DeviceOrientationController(DeviceOrientationClient&);
>     virtual ~DeviceOrientationController() = default;
> 
>     void didChangeDeviceOrientation(DeviceOrientationData*);
>-    DeviceOrientationClient* deviceOrientationClient();
>+    DeviceOrientationClient& deviceOrientationClient();
> 
> #if PLATFORM(IOS_FAMILY)
>     // FIXME: We should look to reconcile the iOS and OpenSource differences with this class
>diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
>index 67eb1a19aff791e62d645d693ad923779b121bdf..76ef4b72bb53e046e7cdc580e05f7b0775ab0707 100644
>--- a/Source/WebCore/dom/Document.cpp
>+++ b/Source/WebCore/dom/Document.cpp
>@@ -519,13 +519,11 @@ Document::Document(Frame* frame, const URL& url, unsigned documentClasses, unsig
>     , m_intersectionObserversNotifyTimer(*this, &Document::notifyIntersectionObserversTimerFired)
> #endif
>     , m_loadEventDelayTimer(*this, &Document::loadEventDelayTimerFired)
>-#if PLATFORM(IOS_FAMILY)
>-#if ENABLE(DEVICE_ORIENTATION)
>+#if PLATFORM(IOS_FAMILY) && ENABLE(DEVICE_ORIENTATION)
>     , m_deviceMotionClient(std::make_unique<DeviceMotionClientIOS>())
>-    , m_deviceMotionController(std::make_unique<DeviceMotionController>(m_deviceMotionClient.get()))
>+    , m_deviceMotionController(std::make_unique<DeviceMotionController>(*m_deviceMotionClient))
>     , m_deviceOrientationClient(std::make_unique<DeviceOrientationClientIOS>())
>-    , m_deviceOrientationController(std::make_unique<DeviceOrientationController>(m_deviceOrientationClient.get()))
>-#endif
>+    , m_deviceOrientationController(std::make_unique<DeviceOrientationController>(*m_deviceOrientationClient))
> #endif
>     , m_pendingTasksTimer(*this, &Document::pendingTasksTimerFired)
>     , m_visualUpdatesSuppressionTimer(*this, &Document::visualUpdatesSuppressionTimerFired)
>@@ -740,22 +738,20 @@ Element* Document::getElementByAccessKey(const String& key)
>     if (key.isEmpty())
>         return nullptr;
>     if (!m_accessKeyMapValid) {
>-        buildAccessKeyMap(this);
>+        buildAccessKeyMap(*this);
>         m_accessKeyMapValid = true;
>     }
>     return m_elementsByAccessKey.get(key.impl());
> }
> 
>-void Document::buildAccessKeyMap(TreeScope* scope)
>+void Document::buildAccessKeyMap(TreeScope& scope)
> {
>-    ASSERT(scope);
>-    for (auto& element : descendantsOfType<Element>(scope->rootNode())) {
>-        const AtomicString& accessKey = element.attributeWithoutSynchronization(accesskeyAttr);
>+    for (auto& element : descendantsOfType<Element>(scope.rootNode())) {
>+        auto& accessKey = element.attributeWithoutSynchronization(accesskeyAttr);
>         if (!accessKey.isEmpty())
>             m_elementsByAccessKey.set(accessKey.impl(), &element);
>-
>-        if (ShadowRoot* root = element.shadowRoot())
>-            buildAccessKeyMap(root);
>+        if (auto* root = element.shadowRoot())
>+            buildAccessKeyMap(*root);
>     }
> }
> 
>@@ -1670,14 +1666,14 @@ void Document::titleElementTextChanged(Element& titleElement)
>     updateTitleFromTitleElement();
> }
> 
>-void Document::registerForVisibilityStateChangedCallbacks(VisibilityChangeClient* client)
>+void Document::registerForVisibilityStateChangedCallbacks(VisibilityChangeClient& client)
> {
>-    m_visibilityStateCallbackClients.add(client);
>+    m_visibilityStateCallbackClients.add(&client);
> }
> 
>-void Document::unregisterForVisibilityStateChangedCallbacks(VisibilityChangeClient* client)
>+void Document::unregisterForVisibilityStateChangedCallbacks(VisibilityChangeClient& client)
> {
>-    m_visibilityStateCallbackClients.remove(client);
>+    m_visibilityStateCallbackClients.remove(&client);
> }
> 
> void Document::visibilityStateChanged()
>@@ -3569,7 +3565,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content, bool
>     }
> 
>     case HTTPHeaderName::SetCookie:
>-        if (is<HTMLDocument>(*this))
>+        if (isHTMLDocument())
>             addConsoleMessage(MessageSource::Security, MessageLevel::Error, "The Set-Cookie meta tag is obsolete and was ignored. Use the HTTP header Set-Cookie or document.cookie instead."_s);
>         break;
> 
>@@ -3979,15 +3975,15 @@ void Document::updateViewportUnitsOnResize()
>     }
> }
> 
>-void Document::addAudioProducer(MediaProducer* audioProducer)
>+void Document::addAudioProducer(MediaProducer& audioProducer)
> {
>-    m_audioProducers.add(audioProducer);
>+    m_audioProducers.add(&audioProducer);
>     updateIsPlayingMedia();
> }
> 
>-void Document::removeAudioProducer(MediaProducer* audioProducer)
>+void Document::removeAudioProducer(MediaProducer& audioProducer)
> {
>-    m_audioProducers.remove(audioProducer);
>+    m_audioProducers.remove(&audioProducer);
>     updateIsPlayingMedia();
> }
> 
>@@ -4082,24 +4078,24 @@ void Document::adjustFocusedNodeOnNodeRemoval(Node& node, NodeRemoval nodeRemova
>     }
> }
> 
>-void Document::hoveredElementDidDetach(Element* element)
>+void Document::hoveredElementDidDetach(Element& element)
> {
>-    if (!m_hoveredElement || element != m_hoveredElement)
>+    if (!m_hoveredElement || &element != m_hoveredElement)
>         return;
> 
>-    m_hoveredElement = element->parentElement();
>+    m_hoveredElement = element.parentElement();
>     while (m_hoveredElement && !m_hoveredElement->renderer())
>         m_hoveredElement = m_hoveredElement->parentElement();
>     if (frame())
>         frame()->eventHandler().scheduleHoverStateUpdate();
> }
> 
>-void Document::elementInActiveChainDidDetach(Element* element)
>+void Document::elementInActiveChainDidDetach(Element& element)
> {
>-    if (!m_activeElement || element != m_activeElement)
>+    if (!m_activeElement || &element != m_activeElement)
>         return;
> 
>-    m_activeElement = element->parentElement();
>+    m_activeElement = element.parentElement();
>     while (m_activeElement && !m_activeElement->renderer())
>         m_activeElement = m_activeElement->parentElement();
> }
>@@ -4445,25 +4441,25 @@ void Document::collectionWillClearIdNameMap(const HTMLCollection& collection)
>     m_nodeListAndCollectionCounts[InvalidateOnIdNameAttrChange]--;
> }
> 
>-void Document::attachNodeIterator(NodeIterator* ni)
>+void Document::attachNodeIterator(NodeIterator& iterator)
> {
>-    m_nodeIterators.add(ni);
>+    m_nodeIterators.add(&iterator);
> }
> 
>-void Document::detachNodeIterator(NodeIterator* ni)
>+void Document::detachNodeIterator(NodeIterator& iterator)
> {
>     // The node iterator can be detached without having been attached if its root node didn't have a document
>     // when the iterator was created, but has it now.
>-    m_nodeIterators.remove(ni);
>+    m_nodeIterators.remove(&iterator);
> }
> 
> void Document::moveNodeIteratorsToNewDocumentSlowCase(Node& node, Document& newDocument)
> {
>     ASSERT(!m_nodeIterators.isEmpty());
>-    for (auto* it : copyToVector(m_nodeIterators)) {
>-        if (&it->root() == &node) {
>-            detachNodeIterator(it);
>-            newDocument.attachNodeIterator(it);
>+    for (auto* iterator : copyToVector(m_nodeIterators)) {
>+        if (&iterator->root() == &node) {
>+            detachNodeIterator(*iterator);
>+            newDocument.attachNodeIterator(*iterator);
>         }
>     }
> }
>@@ -4503,7 +4499,7 @@ void Document::nodeChildrenWillBeRemoved(ContainerNode& container)
> 
>     if (m_markers->hasMarkers()) {
>         for (Text* textNode = TextNodeTraversal::firstChild(container); textNode; textNode = TextNodeTraversal::nextSibling(*textNode))
>-            m_markers->removeMarkers(textNode);
>+            m_markers->removeMarkers(*textNode);
>     }
> }
> 
>@@ -4531,7 +4527,7 @@ void Document::nodeWillBeRemoved(Node& node)
>     }
> 
>     if (is<Text>(node))
>-        m_markers->removeMarkers(&node);
>+        m_markers->removeMarkers(node);
> }
> 
> static Node* fallbackFocusNavigationStartingNodeAfterRemoval(Node& node)
>@@ -4551,7 +4547,7 @@ void Document::adjustFocusNavigationNodeOnNodeRemoval(Node& node, NodeRemoval no
>     }
> }
> 
>-void Document::textInserted(Node* text, unsigned offset, unsigned length)
>+void Document::textInserted(Node& text, unsigned offset, unsigned length)
> {
>     if (!m_ranges.isEmpty()) {
>         for (auto* range : m_ranges)
>@@ -4562,7 +4558,7 @@ void Document::textInserted(Node* text, unsigned offset, unsigned length)
>     m_markers->shiftMarkers(text, offset, length);
> }
> 
>-void Document::textRemoved(Node* text, unsigned offset, unsigned length)
>+void Document::textRemoved(Node& text, unsigned offset, unsigned length)
> {
>     if (!m_ranges.isEmpty()) {
>         for (auto* range : m_ranges)
>@@ -4574,10 +4570,10 @@ void Document::textRemoved(Node* text, unsigned offset, unsigned length)
>     m_markers->shiftMarkers(text, offset + length, 0 - length);
> }
> 
>-void Document::textNodesMerged(Text* oldNode, unsigned offset)
>+void Document::textNodesMerged(Text& oldNode, unsigned offset)
> {
>     if (!m_ranges.isEmpty()) {
>-        NodeWithIndex oldNodeWithIndex(oldNode);
>+        NodeWithIndex oldNodeWithIndex(&oldNode);
>         for (auto* range : m_ranges)
>             range->textNodesMerged(oldNodeWithIndex, offset);
>     }
>@@ -4585,7 +4581,7 @@ void Document::textNodesMerged(Text* oldNode, unsigned offset)
>     // FIXME: This should update markers for spelling and grammar checking.
> }
> 
>-void Document::textNodeSplit(Text* oldNode)
>+void Document::textNodeSplit(Text& oldNode)
> {
>     for (auto* range : m_ranges)
>         range->textNodeSplit(oldNode);
>@@ -4606,15 +4602,15 @@ void Document::createDOMWindow()
>     m_frame->loader().client().didCreateWindow(*m_domWindow);
> }
> 
>-void Document::takeDOMWindowFrom(Document* document)
>+void Document::takeDOMWindowFrom(Document& document)
> {
>     ASSERT(m_frame);
>     ASSERT(!m_domWindow);
>-    ASSERT(document->m_domWindow);
>+    ASSERT(document.m_domWindow);
>     // A valid DOMWindow is needed by CachedFrame for its documents.
>     ASSERT(pageCacheState() == NotInPageCache);
> 
>-    m_domWindow = WTFMove(document->m_domWindow);
>+    m_domWindow = WTFMove(document.m_domWindow);
>     m_domWindow->didSecureTransitionTo(*this);
> 
>     ASSERT(m_domWindow->document() == this);
>@@ -5314,14 +5310,14 @@ void Document::resume(ReasonForSuspension reason)
> #endif
> }
> 
>-void Document::registerForDocumentSuspensionCallbacks(Element* e)
>+void Document::registerForDocumentSuspensionCallbacks(Element& element)
> {
>-    m_documentSuspensionCallbackElements.add(e);
>+    m_documentSuspensionCallbackElements.add(&element);
> }
> 
>-void Document::unregisterForDocumentSuspensionCallbacks(Element* e)
>+void Document::unregisterForDocumentSuspensionCallbacks(Element& element)
> {
>-    m_documentSuspensionCallbackElements.remove(e);
>+    m_documentSuspensionCallbackElements.remove(&element);
> }
> 
> void Document::mediaVolumeDidChange() 
>@@ -5330,14 +5326,14 @@ void Document::mediaVolumeDidChange()
>         element->mediaVolumeDidChange();
> }
> 
>-void Document::registerForMediaVolumeCallbacks(Element* e)
>+void Document::registerForMediaVolumeCallbacks(Element& element)
> {
>-    m_mediaVolumeCallbackElements.add(e);
>+    m_mediaVolumeCallbackElements.add(&element);
> }
> 
>-void Document::unregisterForMediaVolumeCallbacks(Element* e)
>+void Document::unregisterForMediaVolumeCallbacks(Element& element)
> {
>-    m_mediaVolumeCallbackElements.remove(e);
>+    m_mediaVolumeCallbackElements.remove(&element);
> }
> 
> bool Document::audioPlaybackRequiresUserGesture() const
>@@ -5385,29 +5381,29 @@ void Document::privateBrowsingStateDidChange()
> #endif
> }
> 
>-void Document::registerForPrivateBrowsingStateChangedCallbacks(Element* e)
>+void Document::registerForPrivateBrowsingStateChangedCallbacks(Element& element)
> {
>-    m_privateBrowsingStateChangedElements.add(e);
>+    m_privateBrowsingStateChangedElements.add(&element);
> }
> 
>-void Document::unregisterForPrivateBrowsingStateChangedCallbacks(Element* e)
>+void Document::unregisterForPrivateBrowsingStateChangedCallbacks(Element& element)
> {
>-    m_privateBrowsingStateChangedElements.remove(e);
>+    m_privateBrowsingStateChangedElements.remove(&element);
> }
> 
> #if ENABLE(VIDEO_TRACK)
> 
>-void Document::registerForCaptionPreferencesChangedCallbacks(Element* e)
>+void Document::registerForCaptionPreferencesChangedCallbacks(Element& element)
> {
>     if (page())
>         page()->group().captionPreferences().setInterestedInCaptionPreferenceChanges();
> 
>-    m_captionPreferencesChangedElements.add(e);
>+    m_captionPreferencesChangedElements.add(&element);
> }
> 
>-void Document::unregisterForCaptionPreferencesChangedCallbacks(Element* e)
>+void Document::unregisterForCaptionPreferencesChangedCallbacks(Element& element)
> {
>-    m_captionPreferencesChangedElements.remove(e);
>+    m_captionPreferencesChangedElements.remove(&element);
> }
> 
> void Document::captionPreferencesChanged()
>@@ -5420,14 +5416,14 @@ void Document::captionPreferencesChanged()
> 
> #if ENABLE(MEDIA_CONTROLS_SCRIPT)
> 
>-void Document::registerForPageScaleFactorChangedCallbacks(HTMLMediaElement* element)
>+void Document::registerForPageScaleFactorChangedCallbacks(HTMLMediaElement& element)
> {
>-    m_pageScaleFactorChangedElements.add(element);
>+    m_pageScaleFactorChangedElements.add(&element);
> }
> 
>-void Document::unregisterForPageScaleFactorChangedCallbacks(HTMLMediaElement* element)
>+void Document::unregisterForPageScaleFactorChangedCallbacks(HTMLMediaElement& element)
> {
>-    m_pageScaleFactorChangedElements.remove(element);
>+    m_pageScaleFactorChangedElements.remove(&element);
> }
> 
> void Document::pageScaleFactorChangedAndStable()
>@@ -5761,7 +5757,7 @@ void Document::finishedParsing()
> 
>     Ref<Document> protectedThis(*this);
> 
>-    scriptRunner()->documentFinishedParsing();
>+    scriptRunner().documentFinishedParsing();
> 
>     if (!m_documentTiming.domContentLoadedEventStart)
>         m_documentTiming.domContentLoadedEventStart = MonotonicTime::now();
>@@ -6059,17 +6055,17 @@ void Document::statePopped(Ref<SerializedScriptValue>&& stateObject)
>         m_pendingStateObject = WTFMove(stateObject);
> }
> 
>-void Document::attachRange(Range* range)
>+void Document::attachRange(Range& range)
> {
>-    ASSERT(!m_ranges.contains(range));
>-    m_ranges.add(range);
>+    ASSERT(!m_ranges.contains(&range));
>+    m_ranges.add(&range);
> }
> 
>-void Document::detachRange(Range* range)
>+void Document::detachRange(Range& range)
> {
>-    // We don't ASSERT m_ranges.contains(range) to allow us to call this
>+    // We don't ASSERT m_ranges.contains(&range) to allow us to call this
>     // unconditionally to fix: https://bugs.webkit.org/show_bug.cgi?id=26044
>-    m_ranges.remove(range);
>+    m_ranges.remove(&range);
> }
> 
> Optional<RenderingContext> Document::getCSSCanvasContext(const String& type, const String& name, int width, int height)
>@@ -6226,7 +6222,7 @@ void Document::suspendScheduledTasks(ReasonForSuspension reason)
> 
>     suspendScriptedAnimationControllerCallbacks();
>     suspendActiveDOMObjects(reason);
>-    scriptRunner()->suspend();
>+    scriptRunner().suspend();
>     m_pendingTasksTimer.stop();
> 
> #if ENABLE(XSLT)
>@@ -6260,7 +6256,7 @@ void Document::resumeScheduledTasks(ReasonForSuspension reason)
> 
>     if (!m_pendingTasks.isEmpty())
>         m_pendingTasksTimer.startOneShot(0_s);
>-    scriptRunner()->resume();
>+    scriptRunner().resume();
>     resumeActiveDOMObjects(reason);
>     resumeScriptedAnimationControllerCallbacks();
>     
>@@ -6320,16 +6316,16 @@ void Document::dispatchPopstateEvent(RefPtr<SerializedScriptValue>&& stateObject
>     dispatchWindowEvent(PopStateEvent::create(WTFMove(stateObject), m_domWindow ? &m_domWindow->history() : nullptr));
> }
> 
>-void Document::addMediaCanStartListener(MediaCanStartListener* listener)
>+void Document::addMediaCanStartListener(MediaCanStartListener& listener)
> {
>-    ASSERT(!m_mediaCanStartListeners.contains(listener));
>-    m_mediaCanStartListeners.add(listener);
>+    ASSERT(!m_mediaCanStartListeners.contains(&listener));
>+    m_mediaCanStartListeners.add(&listener);
> }
> 
>-void Document::removeMediaCanStartListener(MediaCanStartListener* listener)
>+void Document::removeMediaCanStartListener(MediaCanStartListener& listener)
> {
>-    ASSERT(m_mediaCanStartListeners.contains(listener));
>-    m_mediaCanStartListeners.remove(listener);
>+    ASSERT(m_mediaCanStartListeners.contains(&listener));
>+    m_mediaCanStartListeners.remove(&listener);
> }
> 
> MediaCanStartListener* Document::takeAnyMediaCanStartListener()
>@@ -6339,30 +6335,29 @@ MediaCanStartListener* Document::takeAnyMediaCanStartListener()
> 
> #if ENABLE(DEVICE_ORIENTATION) && PLATFORM(IOS_FAMILY)
> 
>-DeviceMotionController* Document::deviceMotionController() const
>+DeviceMotionController& Document::deviceMotionController() const
> {
>-    return m_deviceMotionController.get();
>+    return *m_deviceMotionController;
> }
> 
>-DeviceOrientationController* Document::deviceOrientationController() const
>+DeviceOrientationController& Document::deviceOrientationController() const
> {
>-    return m_deviceOrientationController.get();
>+    return *m_deviceOrientationController;
> }
> 
> void Document::simulateDeviceOrientationChange(double alpha, double beta, double gamma)
> {
>     auto orientation = DeviceOrientationData::create(alpha, beta, gamma, WTF::nullopt, WTF::nullopt);
>-    deviceOrientationController()->didChangeDeviceOrientation(orientation.ptr());
>+    deviceOrientationController().didChangeDeviceOrientation(orientation.ptr());
> }
> 
> #endif
> 
> #if ENABLE(FULLSCREEN_API)
> 
>-bool Document::fullScreenIsAllowedForElement(Element* element) const
>+bool Document::fullScreenIsAllowedForElement(Element& element) const
> {
>-    ASSERT(element);
>-    return isAttributeOnAllOwners(allowfullscreenAttr, webkitallowfullscreenAttr, element->document().ownerElement());
>+    return isAttributeOnAllOwners(allowfullscreenAttr, webkitallowfullscreenAttr, element.document().ownerElement());
> }
> 
> void Document::requestFullScreenForElement(Element* element, FullScreenCheckType checkType)
>@@ -6431,7 +6426,7 @@ void Document::requestFullScreenForElement(Element* element, FullScreenCheckType
> 
>         // The context object's node document, or an ancestor browsing context's document does not have
>         // the fullscreen enabled flag set.
>-        if (checkType == EnforceIFrameAllowFullScreenRequirement && !fullScreenIsAllowedForElement(element.get())) {
>+        if (checkType == EnforceIFrameAllowFullScreenRequirement && !fullScreenIsAllowedForElement(*element)) {
>             failedPreflights(WTFMove(element));
>             return;
>         }
>@@ -6482,8 +6477,8 @@ void Document::requestFullScreenForElement(Element* element, FullScreenCheckType
>             // stack, and queue a task to fire an event named fullscreenchange with its bubbles attribute
>             // set to true on the document.
>             if (!followingDoc) {
>-                currentDoc->pushFullscreenElementStack(element.get());
>-                addDocumentToFullScreenChangeEventQueue(currentDoc);
>+                currentDoc->pushFullscreenElementStack(*element);
>+                addDocumentToFullScreenChangeEventQueue(*currentDoc);
>                 continue;
>             }
> 
>@@ -6494,8 +6489,8 @@ void Document::requestFullScreenForElement(Element* element, FullScreenCheckType
>                 // ...push following document's browsing context container on document's fullscreen element
>                 // stack, and queue a task to fire an event named fullscreenchange with its bubbles attribute
>                 // set to true on document.
>-                currentDoc->pushFullscreenElementStack(followingDoc->ownerElement());
>-                addDocumentToFullScreenChangeEventQueue(currentDoc);
>+                currentDoc->pushFullscreenElementStack(*followingDoc->ownerElement());
>+                addDocumentToFullScreenChangeEventQueue(*currentDoc);
>                 continue;
>             }
> 
>@@ -6557,7 +6552,7 @@ void Document::webkitExitFullscreen()
>     // task to fire an event named fullscreenchange with its bubbles attribute set to true on descendant.
>     for (auto& document : descendants) {
>         document->clearFullscreenElementStack();
>-        addDocumentToFullScreenChangeEventQueue(document.get());
>+        addDocumentToFullScreenChangeEventQueue(*document);
>     }
> 
>     // 5. While doc is not null, run these substeps:
>@@ -6574,7 +6569,7 @@ void Document::webkitExitFullscreen()
> 
>         // 2. Queue a task to fire an event named fullscreenchange with its bubbles attribute set to true
>         // on doc.
>-        addDocumentToFullScreenChangeEventQueue(currentDoc);
>+        addDocumentToFullScreenChangeEventQueue(*currentDoc);
> 
>         // 3. If doc's fullscreen element stack is empty and doc's browsing context has a browsing context
>         // container, set doc to that browsing context container's node document.
>@@ -6626,13 +6621,11 @@ static void unwrapFullScreenRenderer(RenderFullScreen* fullScreenRenderer, Eleme
>         fullScreenElement->parentElement()->invalidateStyleAndRenderersForSubtree();
> }
> 
>-void Document::webkitWillEnterFullScreenForElement(Element* element)
>+void Document::webkitWillEnterFullScreen(Element& element)
> {
>     if (!hasLivingRenderTree() || pageCacheState() != NotInPageCache)
>         return;
> 
>-    ASSERT(element);
>-
>     // Protect against being called after the document has been removed from the page.
>     if (!page())
>         return;
>@@ -6641,13 +6634,12 @@ void Document::webkitWillEnterFullScreenForElement(Element* element)
> 
>     unwrapFullScreenRenderer(m_fullScreenRenderer.get(), m_fullScreenElement.get());
> 
>-    if (element)
>-        element->willBecomeFullscreenElement();
>+    element.willBecomeFullscreenElement();
>     
>-    m_fullScreenElement = element;
>+    m_fullScreenElement = &element;
> 
> #if USE(NATIVE_FULLSCREEN_VIDEO)
>-    if (element && element->isMediaElement())
>+    if (element.isMediaElement())
>         return;
> #endif
> 
>@@ -6671,7 +6663,7 @@ void Document::webkitWillEnterFullScreenForElement(Element* element)
>     dispatchFullScreenChangeEvents();
> }
> 
>-void Document::webkitDidEnterFullScreenForElement(Element*)
>+void Document::webkitDidEnterFullScreen()
> {
>     if (!m_fullScreenElement)
>         return;
>@@ -6682,7 +6674,7 @@ void Document::webkitDidEnterFullScreenForElement(Element*)
>     m_fullScreenElement->didBecomeFullscreenElement();
> }
> 
>-void Document::webkitWillExitFullScreenForElement(Element*)
>+void Document::webkitWillExitFullScreen()
> {
>     if (!m_fullScreenElement)
>         return;
>@@ -6693,7 +6685,7 @@ void Document::webkitWillExitFullScreenForElement(Element*)
>     m_fullScreenElement->willStopBeingFullscreenElement();
> }
> 
>-void Document::webkitDidExitFullScreenForElement(Element*)
>+void Document::webkitDidExitFullScreen()
> {
>     if (!m_fullScreenElement)
>         return;
>@@ -6845,19 +6837,18 @@ void Document::popFullscreenElementStack()
>     m_fullScreenElementStack.removeLast();
> }
> 
>-void Document::pushFullscreenElementStack(Element* element)
>+void Document::pushFullscreenElementStack(Element& element)
> {
>-    m_fullScreenElementStack.append(element);
>+    m_fullScreenElementStack.append(&element);
> }
> 
>-void Document::addDocumentToFullScreenChangeEventQueue(Document* doc)
>+void Document::addDocumentToFullScreenChangeEventQueue(Document& document)
> {
>-    ASSERT(doc);
>-    Node* target = doc->webkitFullscreenElement();
>+    Node* target = document.webkitFullscreenElement();
>     if (!target)
>-        target = doc->webkitCurrentFullScreenElement();
>+        target = document.webkitCurrentFullScreenElement();
>     if (!target)
>-        target = doc;
>+        target = &document;
>     m_fullScreenChangeEventTargetQueue.append(target);
> }
> 
>@@ -7209,7 +7200,7 @@ Element* eventTargetElementForDocument(Document* document)
>     Element* element = document->focusedElement();
>     if (!element && is<PluginDocument>(*document))
>         element = downcast<PluginDocument>(*document).pluginElement();
>-    if (!element && is<HTMLDocument>(*document))
>+    if (!element && document->isHTMLDocument())
>         element = document->bodyOrFrameset();
>     if (!element)
>         element = document->documentElement();
>@@ -7283,7 +7274,7 @@ DocumentParserYieldToken::DocumentParserYieldToken(Document& document)
>     if (++document.m_parserYieldTokenCount != 1)
>         return;
> 
>-    document.scriptRunner()->didBeginYieldingParser();
>+    document.scriptRunner().didBeginYieldingParser();
>     if (auto* parser = document.parser())
>         parser->didBeginYieldingParser();
> }
>@@ -7297,7 +7288,7 @@ DocumentParserYieldToken::~DocumentParserYieldToken()
>     if (--m_document->m_parserYieldTokenCount)
>         return;
> 
>-    m_document->scriptRunner()->didEndYieldingParser();
>+    m_document->scriptRunner().didEndYieldingParser();
>     if (auto* parser = m_document->parser())
>         parser->didEndYieldingParser();
> }
>@@ -7387,7 +7378,7 @@ void Document::updateHoverActiveState(const HitTestRequest& request, Element* in
>         for (auto* element = oldHoveredElement.get(); element; element = element->parentElementInComposedTree()) {
>             if (element == commonAncestor)
>                 break;
>-            if (!mustBeInActiveChain || element->inActiveChain())
>+            if (!mustBeInActiveChain || element->isInActiveChain())
>                 elementsToRemoveFromChain.append(element);
>         }
>         // Unset hovered nodes in sub frame documents if the old hovered node was a frame owner.
>@@ -7398,7 +7389,7 @@ void Document::updateHoverActiveState(const HitTestRequest& request, Element* in
>     }
> 
>     for (auto* element = newHoveredElement; element; element = element->parentElementInComposedTree()) {
>-        if (!mustBeInActiveChain || element->inActiveChain())
>+        if (!mustBeInActiveChain || element->isInActiveChain())
>             elementsToAddToChain.append(element);
>     }
> 
>diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
>index 308929e47f683fc868f780f76a1845d678f05bfc..9c8c078ff5db23b756dd8661ab31dacf84ef8818 100644
>--- a/Source/WebCore/dom/Document.h
>+++ b/Source/WebCore/dom/Document.h
>@@ -773,8 +773,8 @@ public:
>     void adjustFocusedNodeOnNodeRemoval(Node&, NodeRemoval = NodeRemoval::Node);
>     void adjustFocusNavigationNodeOnNodeRemoval(Node&, NodeRemoval = NodeRemoval::Node);
> 
>-    void hoveredElementDidDetach(Element*);
>-    void elementInActiveChainDidDetach(Element*);
>+    void hoveredElementDidDetach(Element&);
>+    void elementInActiveChainDidDetach(Element&);
> 
>     void updateHoverActiveState(const HitTestRequest&, Element*);
> 
>@@ -801,16 +801,16 @@ public:
>     template <typename InvalidationFunction>
>     void invalidateNodeListAndCollectionCaches(InvalidationFunction);
> 
>-    void attachNodeIterator(NodeIterator*);
>-    void detachNodeIterator(NodeIterator*);
>+    void attachNodeIterator(NodeIterator&);
>+    void detachNodeIterator(NodeIterator&);
>     void moveNodeIteratorsToNewDocument(Node& node, Document& newDocument)
>     {
>         if (!m_nodeIterators.isEmpty())
>             moveNodeIteratorsToNewDocumentSlowCase(node, newDocument);
>     }
> 
>-    void attachRange(Range*);
>-    void detachRange(Range*);
>+    void attachRange(Range&);
>+    void detachRange(Range&);
> 
>     void updateRangesAfterChildrenChanged(ContainerNode&);
>     // nodeChildrenWillBeRemoved is used when removing all node children at once.
>@@ -821,13 +821,13 @@ public:
>     enum class AcceptChildOperation { Replace, InsertOrAdd };
>     bool canAcceptChild(const Node& newChild, const Node* refChild, AcceptChildOperation) const;
> 
>-    void textInserted(Node*, unsigned offset, unsigned length);
>-    void textRemoved(Node*, unsigned offset, unsigned length);
>-    void textNodesMerged(Text* oldNode, unsigned offset);
>-    void textNodeSplit(Text* oldNode);
>+    void textInserted(Node&, unsigned offset, unsigned length);
>+    void textRemoved(Node&, unsigned offset, unsigned length);
>+    void textNodesMerged(Text& oldNode, unsigned offset);
>+    void textNodeSplit(Text& oldNode);
> 
>     void createDOMWindow();
>-    void takeDOMWindowFrom(Document*);
>+    void takeDOMWindowFrom(Document&);
> 
>     DOMWindow* domWindow() const { return m_domWindow.get(); }
>     // In DOM Level 2, the Document's DOMWindow is called the defaultView.
>@@ -906,7 +906,7 @@ public:
> #endif
> 
>     // Returns the owning element in the parent document.
>-    // Returns 0 if this is the top level document.
>+    // Returns nullptr if this is the top level document.
>     HTMLFrameOwnerElement* ownerElement() const;
> 
>     // Used by DOM bindings; no direction known.
>@@ -1018,8 +1018,8 @@ public:
>     Document* parentDocument() const;
>     WEBCORE_EXPORT Document& topDocument() const;
>     
>-    ScriptRunner* scriptRunner() { return m_scriptRunner.get(); }
>-    ScriptModuleLoader* moduleLoader() { return m_moduleLoader.get(); }
>+    ScriptRunner& scriptRunner() { return *m_scriptRunner; }
>+    ScriptModuleLoader& moduleLoader() { return *m_moduleLoader; }
> 
>     HTMLScriptElement* currentScript() const { return !m_currentScriptStack.isEmpty() ? m_currentScriptStack.last().get() : nullptr; }
>     void pushCurrentScript(HTMLScriptElement*);
>@@ -1031,7 +1031,7 @@ public:
>     void scheduleToApplyXSLTransforms();
>     void applyPendingXSLTransformsNowIfScheduled();
>     RefPtr<Document> transformSourceDocument() { return m_transformSourceDocument; }
>-    void setTransformSourceDocument(Document* doc) { m_transformSourceDocument = doc; }
>+    void setTransformSourceDocument(Document* document) { m_transformSourceDocument = document; }
> 
>     void setTransformSource(std::unique_ptr<TransformSource>);
>     TransformSource* transformSource() const { return m_transformSource.get(); }
>@@ -1075,17 +1075,15 @@ public:
>     PageCacheState pageCacheState() const { return m_pageCacheState; }
>     void setPageCacheState(PageCacheState);
> 
>-    // Elements can register themselves for the "suspend()" and
>-    // "resume()" callbacks
>-    void registerForDocumentSuspensionCallbacks(Element*);
>-    void unregisterForDocumentSuspensionCallbacks(Element*);
>+    void registerForDocumentSuspensionCallbacks(Element&);
>+    void unregisterForDocumentSuspensionCallbacks(Element&);
> 
>     void documentWillBecomeInactive();
>     void suspend(ReasonForSuspension);
>     void resume(ReasonForSuspension);
> 
>-    void registerForMediaVolumeCallbacks(Element*);
>-    void unregisterForMediaVolumeCallbacks(Element*);
>+    void registerForMediaVolumeCallbacks(Element&);
>+    void unregisterForMediaVolumeCallbacks(Element&);
>     void mediaVolumeDidChange();
> 
>     bool audioPlaybackRequiresUserGesture() const;
>@@ -1095,28 +1093,28 @@ public:
>     MediaSession& defaultMediaSession();
> #endif
> 
>-    void registerForPrivateBrowsingStateChangedCallbacks(Element*);
>-    void unregisterForPrivateBrowsingStateChangedCallbacks(Element*);
>+    void registerForPrivateBrowsingStateChangedCallbacks(Element&);
>+    void unregisterForPrivateBrowsingStateChangedCallbacks(Element&);
>     void storageBlockingStateDidChange();
>     void privateBrowsingStateDidChange();
> 
> #if ENABLE(VIDEO_TRACK)
>-    void registerForCaptionPreferencesChangedCallbacks(Element*);
>-    void unregisterForCaptionPreferencesChangedCallbacks(Element*);
>+    void registerForCaptionPreferencesChangedCallbacks(Element&);
>+    void unregisterForCaptionPreferencesChangedCallbacks(Element&);
>     void captionPreferencesChanged();
> #endif
> 
> #if ENABLE(MEDIA_CONTROLS_SCRIPT)
>-    void registerForPageScaleFactorChangedCallbacks(HTMLMediaElement*);
>-    void unregisterForPageScaleFactorChangedCallbacks(HTMLMediaElement*);
>+    void registerForPageScaleFactorChangedCallbacks(HTMLMediaElement&);
>+    void unregisterForPageScaleFactorChangedCallbacks(HTMLMediaElement&);
>     void pageScaleFactorChangedAndStable();
>     void registerForUserInterfaceLayoutDirectionChangedCallbacks(HTMLMediaElement&);
>     void unregisterForUserInterfaceLayoutDirectionChangedCallbacks(HTMLMediaElement&);
>     void userInterfaceLayoutDirectionChanged();
> #endif
> 
>-    void registerForVisibilityStateChangedCallbacks(VisibilityChangeClient*);
>-    void unregisterForVisibilityStateChangedCallbacks(VisibilityChangeClient*);
>+    void registerForVisibilityStateChangedCallbacks(VisibilityChangeClient&);
>+    void unregisterForVisibilityStateChangedCallbacks(VisibilityChangeClient&);
> 
> #if ENABLE(VIDEO)
>     void registerForAllowsMediaDocumentInlinePlaybackChangedCallbacks(HTMLMediaElement&);
>@@ -1177,8 +1175,8 @@ public:
>     void dispatchPopstateEvent(RefPtr<SerializedScriptValue>&& stateObject);
>     DocumentEventQueue& eventQueue() const final { return m_eventQueue; }
> 
>-    WEBCORE_EXPORT void addMediaCanStartListener(MediaCanStartListener*);
>-    WEBCORE_EXPORT void removeMediaCanStartListener(MediaCanStartListener*);
>+    WEBCORE_EXPORT void addMediaCanStartListener(MediaCanStartListener&);
>+    WEBCORE_EXPORT void removeMediaCanStartListener(MediaCanStartListener&);
>     MediaCanStartListener* takeAnyMediaCanStartListener();
> 
> #if ENABLE(FULLSCREEN_API)
>@@ -1195,16 +1193,16 @@ public:
>     void requestFullScreenForElement(Element*, FullScreenCheckType);
>     WEBCORE_EXPORT void webkitCancelFullScreen();
>     
>-    WEBCORE_EXPORT void webkitWillEnterFullScreenForElement(Element*);
>-    WEBCORE_EXPORT void webkitDidEnterFullScreenForElement(Element*);
>-    WEBCORE_EXPORT void webkitWillExitFullScreenForElement(Element*);
>-    WEBCORE_EXPORT void webkitDidExitFullScreenForElement(Element*);
>+    WEBCORE_EXPORT void webkitWillEnterFullScreen(Element&);
>+    WEBCORE_EXPORT void webkitDidEnterFullScreen();
>+    WEBCORE_EXPORT void webkitWillExitFullScreen();
>+    WEBCORE_EXPORT void webkitDidExitFullScreen();
>     
>     void setFullScreenRenderer(RenderTreeBuilder&, RenderFullScreen&);
>     RenderFullScreen* fullScreenRenderer() const { return m_fullScreenRenderer.get(); }
> 
>     void dispatchFullScreenChangeEvents();
>-    bool fullScreenIsAllowedForElement(Element*) const;
>+    bool fullScreenIsAllowedForElement(Element&) const;
>     void fullScreenElementRemoved();
>     void adjustFullScreenElementOnNodeRemoval(Node&, NodeRemoval = NodeRemoval::Node);
> 
>@@ -1235,8 +1233,8 @@ public:
> #endif
> 
> #if ENABLE(DEVICE_ORIENTATION) && PLATFORM(IOS_FAMILY)
>-    DeviceMotionController* deviceMotionController() const;
>-    DeviceOrientationController* deviceOrientationController() const;
>+    DeviceMotionController& deviceMotionController() const;
>+    DeviceOrientationController& deviceOrientationController() const;
>     WEBCORE_EXPORT void simulateDeviceOrientationChange(double alpha, double beta, double gamma);
> #endif
> 
>@@ -1380,8 +1378,8 @@ public:
>     bool hasStyleWithViewportUnits() const { return m_hasStyleWithViewportUnits; }
>     void updateViewportUnitsOnResize();
> 
>-    WEBCORE_EXPORT void addAudioProducer(MediaProducer*);
>-    WEBCORE_EXPORT void removeAudioProducer(MediaProducer*);
>+    WEBCORE_EXPORT void addAudioProducer(MediaProducer&);
>+    WEBCORE_EXPORT void removeAudioProducer(MediaProducer&);
>     MediaProducer::MediaStateFlags mediaState() const { return m_mediaState; }
>     void noteUserInteractionWithMediaElement();
>     bool isCapturing() const { return MediaProducer::isCapturing(m_mediaState); }
>@@ -1599,7 +1597,7 @@ private:
>     void updateTitle(const StringWithDirection&);
>     void updateBaseURL();
> 
>-    void buildAccessKeyMap(TreeScope* root);
>+    void buildAccessKeyMap(TreeScope& root);
> 
>     void moveNodeIteratorsToNewDocumentSlowCase(Node&, Document&);
> 
>@@ -1616,8 +1614,8 @@ private:
>     void dispatchFullScreenChangeOrErrorEvent(Deque<RefPtr<Node>>&, const AtomicString& eventName, bool shouldNotifyMediaElement);
>     void clearFullscreenElementStack();
>     void popFullscreenElementStack();
>-    void pushFullscreenElementStack(Element*);
>-    void addDocumentToFullScreenChangeEventQueue(Document*);
>+    void pushFullscreenElementStack(Element&);
>+    void addDocumentToFullScreenChangeEventQueue(Document&);
> #endif
> 
>     void dispatchDisabledAdaptationsDidChangeForMainFrame();
>diff --git a/Source/WebCore/dom/DocumentMarkerController.cpp b/Source/WebCore/dom/DocumentMarkerController.cpp
>index 5b08630c3300b9a7902fa7bcbe22d6e1c2c66c14..5bbcb803e27b7e520350ebb0efb0f2861e9de27f 100644
>--- a/Source/WebCore/dom/DocumentMarkerController.cpp
>+++ b/Source/WebCore/dom/DocumentMarkerController.cpp
>@@ -60,99 +60,99 @@ void DocumentMarkerController::detach()
>     m_possiblyExistingMarkerTypes = { };
> }
> 
>-void DocumentMarkerController::addMarker(Range* range, DocumentMarker::MarkerType type, const String& description)
>+void DocumentMarkerController::addMarker(Range& range, DocumentMarker::MarkerType type, const String& description)
> {
>-    for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
>+    for (TextIterator markedText(&range); !markedText.atEnd(); markedText.advance()) {
>         RefPtr<Range> textPiece = markedText.range();
>-        addMarker(&textPiece->startContainer(), DocumentMarker(type, textPiece->startOffset(), textPiece->endOffset(), description));
>+        addMarker(textPiece->startContainer(), DocumentMarker(type, textPiece->startOffset(), textPiece->endOffset(), description));
>     }
> }
> 
>-void DocumentMarkerController::addMarker(Range* range, DocumentMarker::MarkerType type)
>+void DocumentMarkerController::addMarker(Range& range, DocumentMarker::MarkerType type)
> {
>-    for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
>+    for (TextIterator markedText(&range); !markedText.atEnd(); markedText.advance()) {
>         RefPtr<Range> textPiece = markedText.range();
>-        addMarker(&textPiece->startContainer(), DocumentMarker(type, textPiece->startOffset(), textPiece->endOffset()));
>+        addMarker(textPiece->startContainer(), DocumentMarker(type, textPiece->startOffset(), textPiece->endOffset()));
>     }
> 
> }
> 
>-void DocumentMarkerController::addMarkerToNode(Node* node, unsigned startOffset, unsigned length, DocumentMarker::MarkerType type)
>+void DocumentMarkerController::addMarkerToNode(Node& node, unsigned startOffset, unsigned length, DocumentMarker::MarkerType type)
> {
>     addMarker(node, DocumentMarker(type, startOffset, startOffset + length));
> }
> 
>-void DocumentMarkerController::addMarkerToNode(Node* node, unsigned startOffset, unsigned length, DocumentMarker::MarkerType type, DocumentMarker::Data&& data)
>+void DocumentMarkerController::addMarkerToNode(Node& node, unsigned startOffset, unsigned length, DocumentMarker::MarkerType type, DocumentMarker::Data&& data)
> {
>     addMarker(node, DocumentMarker(type, startOffset, startOffset + length, WTFMove(data)));
> }
> 
>-void DocumentMarkerController::addTextMatchMarker(const Range* range, bool activeMatch)
>+void DocumentMarkerController::addTextMatchMarker(const Range& range, bool activeMatch)
> {
>-    for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
>+    for (TextIterator markedText(&range); !markedText.atEnd(); markedText.advance()) {
>         RefPtr<Range> textPiece = markedText.range();
>         unsigned startOffset = textPiece->startOffset();
>         unsigned endOffset = textPiece->endOffset();
>-        addMarker(&textPiece->startContainer(), DocumentMarker(startOffset, endOffset, activeMatch));
>+        addMarker(textPiece->startContainer(), DocumentMarker(startOffset, endOffset, activeMatch));
>     }
> }
> 
> #if PLATFORM(IOS_FAMILY)
> 
>-void DocumentMarkerController::addMarker(Range* range, DocumentMarker::MarkerType type, const String& description, const Vector<String>& interpretations, const RetainPtr<id>& metadata)
>+void DocumentMarkerController::addMarker(Range& range, DocumentMarker::MarkerType type, const String& description, const Vector<String>& interpretations, const RetainPtr<id>& metadata)
> {
>-    for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
>+    for (TextIterator markedText(&range); !markedText.atEnd(); markedText.advance()) {
>         RefPtr<Range> textPiece = markedText.range();
>-        addMarker(&textPiece->startContainer(), DocumentMarker(type, textPiece->startOffset(), textPiece->endOffset(), description, interpretations, metadata));
>+        addMarker(textPiece->startContainer(), DocumentMarker(type, textPiece->startOffset(), textPiece->endOffset(), description, interpretations, metadata));
>     }
> }
> 
>-void DocumentMarkerController::addDictationPhraseWithAlternativesMarker(Range* range, const Vector<String>& interpretations)
>+void DocumentMarkerController::addDictationPhraseWithAlternativesMarker(Range& range, const Vector<String>& interpretations)
> {
>     ASSERT(interpretations.size() > 1);
>     if (interpretations.size() <= 1)
>         return;
> 
>     size_t numberOfAlternatives = interpretations.size() - 1;
>-    for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
>+    for (TextIterator markedText(&range); !markedText.atEnd(); markedText.advance()) {
>         RefPtr<Range> textPiece = markedText.range();
>         DocumentMarker marker(DocumentMarker::DictationPhraseWithAlternatives, textPiece->startOffset(), textPiece->endOffset(), emptyString(), Vector<String>(numberOfAlternatives), RetainPtr<id>());
>         for (size_t i = 0; i < numberOfAlternatives; ++i)
>             marker.setAlternative(interpretations[i + 1], i);
>-        addMarker(&textPiece->startContainer(), marker);
>+        addMarker(textPiece->startContainer(), marker);
>     }
> }
> 
>-void DocumentMarkerController::addDictationResultMarker(Range* range, const RetainPtr<id>& metadata)
>+void DocumentMarkerController::addDictationResultMarker(Range& range, const RetainPtr<id>& metadata)
> {
>-    for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
>+    for (TextIterator markedText(&range); !markedText.atEnd(); markedText.advance()) {
>         RefPtr<Range> textPiece = markedText.range();
>-        addMarker(&textPiece->startContainer(), DocumentMarker(DocumentMarker::DictationResult, textPiece->startOffset(), textPiece->endOffset(), String(), Vector<String>(), metadata));
>+        addMarker(textPiece->startContainer(), DocumentMarker(DocumentMarker::DictationResult, textPiece->startOffset(), textPiece->endOffset(), String(), Vector<String>(), metadata));
>     }
> }
> 
> #endif
> 
>-void DocumentMarkerController::addDraggedContentMarker(RefPtr<Range> range)
>+void DocumentMarkerController::addDraggedContentMarker(Range& range)
> {
>-    for (TextIterator markedText(range.get()); !markedText.atEnd(); markedText.advance()) {
>-        RefPtr<Range> textPiece = markedText.range();
>+    for (TextIterator markedText(&range); !markedText.atEnd(); markedText.advance()) {
>+        auto textPiece = markedText.range();
>         DocumentMarker::DraggedContentData draggedContentData { markedText.node() };
>-        addMarker(&textPiece->startContainer(), { DocumentMarker::DraggedContent, textPiece->startOffset(), textPiece->endOffset(), WTFMove(draggedContentData) });
>+        addMarker(textPiece->startContainer(), { DocumentMarker::DraggedContent, textPiece->startOffset(), textPiece->endOffset(), WTFMove(draggedContentData) });
>     }
> }
> 
>-void DocumentMarkerController::removeMarkers(Range* range, OptionSet<DocumentMarker::MarkerType> markerTypes, RemovePartiallyOverlappingMarkerOrNot shouldRemovePartiallyOverlappingMarker)
>+void DocumentMarkerController::removeMarkers(Range& range, OptionSet<DocumentMarker::MarkerType> markerTypes, RemovePartiallyOverlappingMarkerOrNot shouldRemovePartiallyOverlappingMarker)
> {
>-    for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
>+    for (TextIterator markedText(&range); !markedText.atEnd(); markedText.advance()) {
>         if (!possiblyHasMarkers(markerTypes))
>             return;
>         ASSERT(!m_markers.isEmpty());
> 
>-        RefPtr<Range> textPiece = markedText.range();
>+        auto textPiece = markedText.range();
>         unsigned startOffset = textPiece->startOffset();
>         unsigned endOffset = textPiece->endOffset();
>-        removeMarkers(&textPiece->startContainer(), startOffset, endOffset - startOffset, markerTypes, shouldRemovePartiallyOverlappingMarker);
>+        removeMarkers(textPiece->startContainer(), startOffset, endOffset - startOffset, markerTypes, shouldRemovePartiallyOverlappingMarker);
>     }
> }
> 
>@@ -315,13 +315,13 @@ static bool shouldInsertAsSeparateMarker(const DocumentMarker& newMarker)
> // Markers are stored in order sorted by their start offset.
> // Markers of the same type do not overlap each other.
> 
>-void DocumentMarkerController::addMarker(Node* node, const DocumentMarker& newMarker) 
>+void DocumentMarkerController::addMarker(Node& node, const DocumentMarker& newMarker)
> {
>     ASSERT(newMarker.endOffset() >= newMarker.startOffset());
>     if (newMarker.endOffset() == newMarker.startOffset())
>         return;
> 
>-    if (auto* renderer = node->renderer()) {
>+    if (auto* renderer = node.renderer()) {
>         // FIXME: Factor the marker painting code out of InlineTextBox and teach simple line layout to use it.
>         if (is<RenderText>(*renderer))
>             downcast<RenderText>(*renderer).ensureLineBoxes();
>@@ -331,7 +331,7 @@ void DocumentMarkerController::addMarker(Node* node, const DocumentMarker& newMa
> 
>     m_possiblyExistingMarkerTypes.add(newMarker.type());
> 
>-    std::unique_ptr<MarkerList>& list = m_markers.add(node, nullptr).iterator->value;
>+    std::unique_ptr<MarkerList>& list = m_markers.add(&node, nullptr).iterator->value;
> 
>     if (!list) {
>         list = std::make_unique<MarkerList>();
>@@ -386,15 +386,15 @@ void DocumentMarkerController::addMarker(Node* node, const DocumentMarker& newMa
>         list->insert(i, RenderedDocumentMarker(toInsert));
>     }
> 
>-    if (node->renderer())
>-        node->renderer()->repaint();
>+    if (node.renderer())
>+        node.renderer()->repaint();
> 
>-    invalidateRectsForMarkersInNode(*node);
>+    invalidateRectsForMarkersInNode(node);
> }
> 
> // copies markers from srcNode to dstNode, applying the specified shift delta to the copies.  The shift is
> // useful if, e.g., the caller has created the dstNode from a non-prefix substring of the srcNode.
>-void DocumentMarkerController::copyMarkers(Node* srcNode, unsigned startOffset, int length, Node* dstNode, int delta)
>+void DocumentMarkerController::copyMarkers(Node& srcNode, unsigned startOffset, int length, Node& dstNode, int delta)
> {
>     if (length <= 0)
>         return;
>@@ -403,7 +403,7 @@ void DocumentMarkerController::copyMarkers(Node* srcNode, unsigned startOffset,
>         return;
>     ASSERT(!m_markers.isEmpty());
> 
>-    MarkerList* list = m_markers.get(srcNode);
>+    MarkerList* list = m_markers.get(&srcNode);
>     if (!list)
>         return;
> 
>@@ -429,11 +429,11 @@ void DocumentMarkerController::copyMarkers(Node* srcNode, unsigned startOffset,
>         addMarker(dstNode, marker);
>     }
> 
>-    if (docDirty && dstNode->renderer())
>-        dstNode->renderer()->repaint();
>+    if (docDirty && dstNode.renderer())
>+        dstNode.renderer()->repaint();
> }
> 
>-void DocumentMarkerController::removeMarkers(Node* node, unsigned startOffset, int length, OptionSet<DocumentMarker::MarkerType> markerTypes, RemovePartiallyOverlappingMarkerOrNot shouldRemovePartiallyOverlappingMarker)
>+void DocumentMarkerController::removeMarkers(Node& node, unsigned startOffset, int length, OptionSet<DocumentMarker::MarkerType> markerTypes, RemovePartiallyOverlappingMarkerOrNot shouldRemovePartiallyOverlappingMarker)
> {
>     if (length <= 0)
>         return;
>@@ -442,7 +442,7 @@ void DocumentMarkerController::removeMarkers(Node* node, unsigned startOffset, i
>         return;
>     ASSERT(!(m_markers.isEmpty()));
> 
>-    MarkerList* list = m_markers.get(node);
>+    MarkerList* list = m_markers.get(&node);
>     if (!list)
>         return;
> 
>@@ -489,13 +489,13 @@ void DocumentMarkerController::removeMarkers(Node* node, unsigned startOffset, i
>     }
> 
>     if (list->isEmpty()) {
>-        m_markers.remove(node);
>+        m_markers.remove(&node);
>         if (m_markers.isEmpty())
>             m_possiblyExistingMarkerTypes = { };
>     }
> 
>-    if (docDirty && node->renderer())
>-        node->renderer()->repaint();
>+    if (docDirty && node.renderer())
>+        node.renderer()->repaint();
> }
> 
> DocumentMarker* DocumentMarkerController::markerContainingPoint(const LayoutPoint& point, DocumentMarker::MarkerType markerType)
>@@ -563,13 +563,13 @@ Vector<RenderedDocumentMarker*> DocumentMarkerController::markersInRange(Range&
>     return foundMarkers;
> }
> 
>-void DocumentMarkerController::removeMarkers(Node* node, OptionSet<DocumentMarker::MarkerType> markerTypes)
>+void DocumentMarkerController::removeMarkers(Node& node, OptionSet<DocumentMarker::MarkerType> markerTypes)
> {
>     if (!possiblyHasMarkers(markerTypes))
>         return;
>     ASSERT(!m_markers.isEmpty());
>     
>-    auto iterator = m_markers.find(node);
>+    auto iterator = m_markers.find(&node);
>     if (iterator != m_markers.end())
>         removeMarkersFromList(iterator, markerTypes);
> }
>@@ -658,13 +658,13 @@ void DocumentMarkerController::repaintMarkers(OptionSet<DocumentMarker::MarkerTy
>     }
> }
> 
>-void DocumentMarkerController::shiftMarkers(Node* node, unsigned startOffset, int delta)
>+void DocumentMarkerController::shiftMarkers(Node& node, unsigned startOffset, int delta)
> {
>     if (!possiblyHasMarkers(DocumentMarker::allMarkers()))
>         return;
>     ASSERT(!m_markers.isEmpty());
> 
>-    MarkerList* list = m_markers.get(node);
>+    MarkerList* list = m_markers.get(&node);
>     if (!list)
>         return;
> 
>@@ -675,7 +675,7 @@ void DocumentMarkerController::shiftMarkers(Node* node, unsigned startOffset, in
> #if PLATFORM(IOS_FAMILY)
>         int targetStartOffset = marker.startOffset() + delta;
>         int targetEndOffset = marker.endOffset() + delta;
>-        if (targetStartOffset >= node->maxCharacterOffset() || targetEndOffset <= 0) {
>+        if (targetStartOffset >= node.maxCharacterOffset() || targetEndOffset <= 0) {
>             list->remove(i);
>             continue;
>         }
>@@ -694,7 +694,7 @@ void DocumentMarkerController::shiftMarkers(Node* node, unsigned startOffset, in
>                 list->remove(i);
>                 continue;
>             }
>-            marker.setEndOffset(targetEndOffset < node->maxCharacterOffset() ? targetEndOffset : node->maxCharacterOffset());
>+            marker.setEndOffset(targetEndOffset < node.maxCharacterOffset() ? targetEndOffset : node.maxCharacterOffset());
>             didShiftMarker = true;
>         }
> #endif
>@@ -702,34 +702,34 @@ void DocumentMarkerController::shiftMarkers(Node* node, unsigned startOffset, in
>     }
> 
>     if (didShiftMarker) {
>-        invalidateRectsForMarkersInNode(*node);
>+        invalidateRectsForMarkersInNode(node);
> 
>-        if (node->renderer())
>-            node->renderer()->repaint();
>+        if (node.renderer())
>+            node.renderer()->repaint();
>     }
> }
> 
>-void DocumentMarkerController::setMarkersActive(Range* range, bool active)
>+void DocumentMarkerController::setMarkersActive(Range& range, bool active)
> {
>     if (!possiblyHasMarkers(DocumentMarker::allMarkers()))
>         return;
>     ASSERT(!m_markers.isEmpty());
> 
>-    Node& startContainer = range->startContainer();
>-    Node& endContainer = range->endContainer();
>+    Node& startContainer = range.startContainer();
>+    Node& endContainer = range.endContainer();
> 
>-    Node* pastLastNode = range->pastLastNode();
>+    Node* pastLastNode = range.pastLastNode();
> 
>-    for (Node* node = range->firstNode(); node != pastLastNode; node = NodeTraversal::next(*node)) {
>-        unsigned startOffset = node == &startContainer ? range->startOffset() : 0;
>-        unsigned endOffset = node == &endContainer ? range->endOffset() : std::numeric_limits<unsigned>::max();
>-        setMarkersActive(node, startOffset, endOffset, active);
>+    for (Node* node = range.firstNode(); node != pastLastNode; node = NodeTraversal::next(*node)) {
>+        unsigned startOffset = node == &startContainer ? range.startOffset() : 0;
>+        unsigned endOffset = node == &endContainer ? range.endOffset() : std::numeric_limits<unsigned>::max();
>+        setMarkersActive(*node, startOffset, endOffset, active);
>     }
> }
> 
>-void DocumentMarkerController::setMarkersActive(Node* node, unsigned startOffset, unsigned endOffset, bool active)
>+void DocumentMarkerController::setMarkersActive(Node& node, unsigned startOffset, unsigned endOffset, bool active)
> {
>-    MarkerList* list = m_markers.get(node);
>+    MarkerList* list = m_markers.get(&node);
>     if (!list)
>         return;
> 
>@@ -747,8 +747,8 @@ void DocumentMarkerController::setMarkersActive(Node* node, unsigned startOffset
>         didActivateMarker = true;
>     }
> 
>-    if (didActivateMarker && node->renderer())
>-        node->renderer()->repaint();
>+    if (didActivateMarker && node.renderer())
>+        node.renderer()->repaint();
> }
> 
> bool DocumentMarkerController::hasMarkers(Range& range, OptionSet<DocumentMarker::MarkerType> markerTypes)
>diff --git a/Source/WebCore/dom/DocumentMarkerController.h b/Source/WebCore/dom/DocumentMarkerController.h
>index dd7d64f086596ac7f0efe014c154028a2a5a9608..82e03f5a15c295e4eb310088a6a30c6b3e2b9ee4 100644
>--- a/Source/WebCore/dom/DocumentMarkerController.h
>+++ b/Source/WebCore/dom/DocumentMarkerController.h
>@@ -3,7 +3,7 @@
>  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
>  *           (C) 2001 Dirk Mueller (mueller@kde.org)
>  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
>- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
>+ * Copyright (C) 2004-2019 Apple Inc. All rights reserved.
>  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
>  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
>  *
>@@ -48,19 +48,19 @@ public:
>     ~DocumentMarkerController();
> 
>     void detach();
>-    void addMarker(Range*, DocumentMarker::MarkerType);
>-    void addMarker(Range*, DocumentMarker::MarkerType, const String& description);
>-    void addMarkerToNode(Node*, unsigned startOffset, unsigned length, DocumentMarker::MarkerType);
>-    void addMarkerToNode(Node*, unsigned startOffset, unsigned length, DocumentMarker::MarkerType, DocumentMarker::Data&&);
>-    WEBCORE_EXPORT void addTextMatchMarker(const Range*, bool activeMatch);
>+    void addMarker(Range&, DocumentMarker::MarkerType);
>+    void addMarker(Range&, DocumentMarker::MarkerType, const String& description);
>+    void addMarkerToNode(Node&, unsigned startOffset, unsigned length, DocumentMarker::MarkerType);
>+    void addMarkerToNode(Node&, unsigned startOffset, unsigned length, DocumentMarker::MarkerType, DocumentMarker::Data&&);
>+    WEBCORE_EXPORT void addTextMatchMarker(const Range&, bool activeMatch);
> #if PLATFORM(IOS_FAMILY)
>-    void addMarker(Range*, DocumentMarker::MarkerType, const String& description, const Vector<String>& interpretations, const RetainPtr<id>& metadata);
>-    void addDictationPhraseWithAlternativesMarker(Range*, const Vector<String>& interpretations);
>-    void addDictationResultMarker(Range*, const RetainPtr<id>& metadata);
>+    void addMarker(Range&, DocumentMarker::MarkerType, const String& description, const Vector<String>& interpretations, const RetainPtr<id>& metadata);
>+    void addDictationPhraseWithAlternativesMarker(Range&, const Vector<String>& interpretations);
>+    void addDictationResultMarker(Range&, const RetainPtr<id>& metadata);
> #endif
>-    void addDraggedContentMarker(RefPtr<Range>);
>+    void addDraggedContentMarker(Range&);
> 
>-    void copyMarkers(Node* srcNode, unsigned startOffset, int length, Node* dstNode, int delta);
>+    void copyMarkers(Node& srcNode, unsigned startOffset, int length, Node& dstNode, int delta);
>     bool hasMarkers() const
>     {
>         ASSERT(m_markers.isEmpty() == !m_possiblyExistingMarkerTypes.containsAny(DocumentMarker::allMarkers()));
>@@ -72,15 +72,15 @@ public:
>     // remove the marker. If the argument is false, we will adjust the span of the marker so that it retains
>     // the portion that is outside of the range.
>     enum RemovePartiallyOverlappingMarkerOrNot { DoNotRemovePartiallyOverlappingMarker, RemovePartiallyOverlappingMarker };
>-    void removeMarkers(Range*, OptionSet<DocumentMarker::MarkerType> = DocumentMarker::allMarkers(), RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
>-    void removeMarkers(Node*, unsigned startOffset, int length, OptionSet<DocumentMarker::MarkerType> = DocumentMarker::allMarkers(),  RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
>+    void removeMarkers(Range&, OptionSet<DocumentMarker::MarkerType> = DocumentMarker::allMarkers(), RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
>+    void removeMarkers(Node&, unsigned startOffset, int length, OptionSet<DocumentMarker::MarkerType> = DocumentMarker::allMarkers(),  RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
> 
>     WEBCORE_EXPORT void removeMarkers(OptionSet<DocumentMarker::MarkerType> = DocumentMarker::allMarkers());
>-    void removeMarkers(Node*, OptionSet<DocumentMarker::MarkerType> = DocumentMarker::allMarkers());
>+    void removeMarkers(Node&, OptionSet<DocumentMarker::MarkerType> = DocumentMarker::allMarkers());
>     void repaintMarkers(OptionSet<DocumentMarker::MarkerType> = DocumentMarker::allMarkers());
>-    void shiftMarkers(Node*, unsigned startOffset, int delta);
>-    void setMarkersActive(Range*, bool);
>-    void setMarkersActive(Node*, unsigned startOffset, unsigned endOffset, bool);
>+    void shiftMarkers(Node&, unsigned startOffset, int delta);
>+    void setMarkersActive(Range&, bool);
>+    void setMarkersActive(Node&, unsigned startOffset, unsigned endOffset, bool);
> 
>     WEBCORE_EXPORT Vector<RenderedDocumentMarker*> markersFor(Node&, OptionSet<DocumentMarker::MarkerType> = DocumentMarker::allMarkers());
>     WEBCORE_EXPORT Vector<RenderedDocumentMarker*> markersInRange(Range&, OptionSet<DocumentMarker::MarkerType>);
>@@ -99,7 +99,7 @@ public:
> #endif
> 
> private:
>-    void addMarker(Node*, const DocumentMarker&);
>+    void addMarker(Node&, const DocumentMarker&);
> 
>     typedef Vector<RenderedDocumentMarker> MarkerList;
>     typedef HashMap<RefPtr<Node>, std::unique_ptr<MarkerList>> MarkerMap;
>diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
>index da5cd2f081c1e88f8111efff326df2026444c43a..b2f13d022c09873252479cbeaa5086270a842bd6 100644
>--- a/Source/WebCore/dom/Element.cpp
>+++ b/Source/WebCore/dom/Element.cpp
>@@ -200,7 +200,7 @@ Element::~Element()
>         detachAllAttrNodesFromElement();
> 
>     if (hasPendingResources()) {
>-        document().accessSVGExtensions().removeElementFromPendingResources(this);
>+        document().accessSVGExtensions().removeElementFromPendingResources(*this);
>         ASSERT(!hasPendingResources());
>     }
> }
>@@ -546,7 +546,7 @@ bool Element::isFocusable() const
> bool Element::isUserActionElementInActiveChain() const
> {
>     ASSERT(isUserActionElement());
>-    return document().userActionElements().inActiveChain(*this);
>+    return document().userActionElements().isInActiveChain(*this);
> }
> 
> bool Element::isUserActionElementActive() const
>@@ -1843,16 +1843,16 @@ bool Element::hasAttributes() const
>     return elementData() && elementData()->length();
> }
> 
>-bool Element::hasEquivalentAttributes(const Element* other) const
>+bool Element::hasEquivalentAttributes(const Element& other) const
> {
>     synchronizeAllAttributes();
>-    other->synchronizeAllAttributes();
>-    if (elementData() == other->elementData())
>+    other.synchronizeAllAttributes();
>+    if (elementData() == other.elementData())
>         return true;
>     if (elementData())
>-        return elementData()->isEquivalent(other->elementData());
>-    if (other->elementData())
>-        return other->elementData()->isEquivalent(elementData());
>+        return elementData()->isEquivalent(other.elementData());
>+    if (other.elementData())
>+        return other.elementData()->isEquivalent(elementData());
>     return true;
> }
> 
>@@ -2013,7 +2013,7 @@ void Element::removedFromAncestor(RemovalType removalType, ContainerNode& oldPar
>     ContainerNode::removedFromAncestor(removalType, oldParentOfRemovedTree);
> 
>     if (hasPendingResources())
>-        document().accessSVGExtensions().removeElementFromPendingResources(this);
>+        document().accessSVGExtensions().removeElementFromPendingResources(*this);
> 
>     RefPtr<Frame> frame = document().frame();
>     if (auto* timeline = document().existingTimeline())
>@@ -3768,9 +3768,9 @@ void Element::clearHoverAndActiveStatusBeforeDetachingRenderer()
>     if (!isUserActionElement())
>         return;
>     if (hovered())
>-        document().hoveredElementDidDetach(this);
>-    if (inActiveChain())
>-        document().elementInActiveChainDidDetach(this);
>+        document().hoveredElementDidDetach(*this);
>+    if (isInActiveChain())
>+        document().elementInActiveChainDidDetach(*this);
>     document().userActionElements().clearActiveAndHovered(*this);
> }
> 
>diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
>index 169fde13adb627041fdd8b5e6f5b8f2adcb386f3..c5eb6cb8c448b099c5e0126ad5a1e7c4e8842b86 100644
>--- a/Source/WebCore/dom/Element.h
>+++ b/Source/WebCore/dom/Element.h
>@@ -278,7 +278,7 @@ public:
> 
>     virtual void didMoveToNewDocument(Document& oldDocument, Document& newDocument);
> 
>-    bool hasEquivalentAttributes(const Element* other) const;
>+    bool hasEquivalentAttributes(const Element& other) const;
> 
>     virtual void copyNonAttributePropertiesFromElement(const Element&) { }
> 
>@@ -305,7 +305,7 @@ public:
>     // FIXME: this should not be virtual, do not override this.
>     virtual const AtomicString& shadowPseudoId() const;
> 
>-    bool inActiveChain() const { return isUserActionElement() && isUserActionElementInActiveChain(); }
>+    bool isInActiveChain() const { return isUserActionElement() && isUserActionElementInActiveChain(); }
>     bool active() const { return isUserActionElement() && isUserActionElementActive(); }
>     bool hovered() const { return isUserActionElement() && isUserActionElementHovered(); }
>     bool focused() const { return isUserActionElement() && isUserActionElementFocused(); }
>@@ -626,11 +626,6 @@ private:
> 
>     virtual void didAddUserAgentShadowRoot(ShadowRoot&) { }
> 
>-    // FIXME: Remove the need for Attr to call willModifyAttribute/didModifyAttribute.
>-    friend class Attr;
>-
>-    enum SynchronizationOfLazyAttribute { NotInSynchronizationOfLazyAttribute = 0, InSynchronizationOfLazyAttribute };
>-
>     void didAddAttribute(const QualifiedName&, const AtomicString&);
>     void willModifyAttribute(const QualifiedName&, const AtomicString& oldValue, const AtomicString& newValue);
>     void didModifyAttribute(const QualifiedName&, const AtomicString& oldValue, const AtomicString& newValue);
>@@ -658,6 +653,7 @@ private:
>     NodeType nodeType() const final;
>     bool childTypeAllowed(NodeType) const final;
> 
>+    enum SynchronizationOfLazyAttribute { NotInSynchronizationOfLazyAttribute, InSynchronizationOfLazyAttribute };
>     void setAttributeInternal(unsigned index, const QualifiedName&, const AtomicString& value, SynchronizationOfLazyAttribute);
>     void addAttributeInternal(const QualifiedName&, const AtomicString& value, SynchronizationOfLazyAttribute);
>     void removeAttributeInternal(unsigned index, SynchronizationOfLazyAttribute);
>diff --git a/Source/WebCore/dom/NamedNodeMap.cpp b/Source/WebCore/dom/NamedNodeMap.cpp
>index 5b74a2b359884d25652fdee280af8f22670b52d0..17bcee6ea7382cb0cb5833f12ab5dc54b47d60d7 100644
>--- a/Source/WebCore/dom/NamedNodeMap.cpp
>+++ b/Source/WebCore/dom/NamedNodeMap.cpp
>@@ -26,7 +26,6 @@
> #include "NamedNodeMap.h"
> 
> #include "Attr.h"
>-#include "HTMLDocument.h"
> #include "HTMLElement.h"
> 
> namespace WebCore {
>@@ -66,7 +65,7 @@ ExceptionOr<Ref<Attr>> NamedNodeMap::removeNamedItem(const AtomicString& name)
> Vector<String> NamedNodeMap::supportedPropertyNames() const
> {
>     Vector<String> names = m_element.getAttributeNames();
>-    if (is<HTMLElement>(m_element) && is<HTMLDocument>(m_element.document())) {
>+    if (is<HTMLElement>(m_element) && m_element.document().isHTMLDocument()) {
>         names.removeAllMatching([](String& name) {
>             for (auto character : StringView { name }.codeUnits()) {
>                 if (isASCIIUpper(character))
>diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
>index 07c2f65d0eb44d57d0b29124f2592025c280e7d8..019caff3e0fa68ea32a8a45d0e1ee0db0ce7c903 100644
>--- a/Source/WebCore/dom/Node.cpp
>+++ b/Source/WebCore/dom/Node.cpp
>@@ -660,7 +660,7 @@ void Node::normalize()
>         while (Node* nextSibling = node->nextSibling()) {
>             if (nextSibling->nodeType() != TEXT_NODE)
>                 break;
>-            RefPtr<Text> nextText = downcast<Text>(nextSibling);
>+            Ref<Text> nextText = downcast<Text>(*nextSibling);
> 
>             // Remove empty text nodes.
>             if (!nextText->length()) {
>@@ -671,7 +671,7 @@ void Node::normalize()
>             // Both non-empty text nodes. Merge them.
>             unsigned offset = text->length();
>             text->appendData(nextText->data());
>-            document().textNodesMerged(nextText.get(), offset);
>+            document().textNodesMerged(nextText, offset);
>             nextText->remove();
>         }
> 
>@@ -1379,7 +1379,7 @@ bool Node::isEqualNode(Node* other) const
>         auto& otherElement = downcast<Element>(*other);
>         if (thisElement.tagQName() != otherElement.tagQName())
>             return false;
>-        if (!thisElement.hasEquivalentAttributes(&otherElement))
>+        if (!thisElement.hasEquivalentAttributes(otherElement))
>             return false;
>         break;
>         }
>diff --git a/Source/WebCore/dom/NodeIterator.cpp b/Source/WebCore/dom/NodeIterator.cpp
>index 45d860ba86f490366198bfe8464f1c26512e9b79..f6f102069b9efc41a425cf6da3c2477beeda12e0 100644
>--- a/Source/WebCore/dom/NodeIterator.cpp
>+++ b/Source/WebCore/dom/NodeIterator.cpp
>@@ -73,7 +73,7 @@ inline NodeIterator::NodeIterator(Node& rootNode, unsigned whatToShow, RefPtr<No
>     : NodeIteratorBase(rootNode, whatToShow, WTFMove(filter))
>     , m_referenceNode(rootNode, true)
> {
>-    root().document().attachNodeIterator(this);
>+    root().document().attachNodeIterator(*this);
> }
> 
> Ref<NodeIterator> NodeIterator::create(Node& rootNode, unsigned whatToShow, RefPtr<NodeFilter>&& filter)
>@@ -83,7 +83,7 @@ Ref<NodeIterator> NodeIterator::create(Node& rootNode, unsigned whatToShow, RefP
> 
> NodeIterator::~NodeIterator()
> {
>-    root().document().detachNodeIterator(this);
>+    root().document().detachNodeIterator(*this);
> }
> 
> ExceptionOr<RefPtr<Node>> NodeIterator::nextNode()
>diff --git a/Source/WebCore/dom/RadioButtonGroups.cpp b/Source/WebCore/dom/RadioButtonGroups.cpp
>index b807befad303f6cf4c10c266f9658565a080f8bc..679ebe26e5630dfb51886685648b674c7d9c3b45 100644
>--- a/Source/WebCore/dom/RadioButtonGroups.cpp
>+++ b/Source/WebCore/dom/RadioButtonGroups.cpp
>@@ -33,18 +33,17 @@ public:
>     bool isEmpty() const { return m_members.isEmpty(); }
>     bool isRequired() const { return m_requiredCount; }
>     HTMLInputElement* checkedButton() const { return m_checkedButton; }
>-    void add(HTMLInputElement*);
>-    void updateCheckedState(HTMLInputElement*);
>+    void add(HTMLInputElement&);
>+    void updateCheckedState(HTMLInputElement&);
>     void requiredStateChanged(HTMLInputElement&);
>-    void remove(HTMLInputElement*);
>-    bool contains(HTMLInputElement*) const;
>+    void remove(HTMLInputElement&);
>+    bool contains(HTMLInputElement&) const;
>     Vector<HTMLInputElement*> members() const;
> 
> private:
>     void setNeedsStyleRecalcForAllButtons();
>     void updateValidityForAllButtons();
>     bool isValid() const;
>-    void changeCheckedButton(HTMLInputElement*);
>     void setCheckedButton(HTMLInputElement*);
> 
>     HashSet<HTMLInputElement*> m_members;
>@@ -80,16 +79,16 @@ void RadioButtonGroup::setCheckedButton(HTMLInputElement* button)
>         oldCheckedButton->setChecked(false);
> }
> 
>-void RadioButtonGroup::add(HTMLInputElement* button)
>+void RadioButtonGroup::add(HTMLInputElement& button)
> {
>-    ASSERT(button->isRadioButton());
>-    if (!m_members.add(button).isNewEntry)
>+    ASSERT(button.isRadioButton());
>+    if (!m_members.add(&button).isNewEntry)
>         return;
>     bool groupWasValid = isValid();
>-    if (button->isRequired())
>+    if (button.isRequired())
>         ++m_requiredCount;
>-    if (button->checked())
>-        setCheckedButton(button);
>+    if (button.checked())
>+        setCheckedButton(&button);
> 
>     bool groupIsValid = isValid();
>     if (groupWasValid != groupIsValid)
>@@ -97,19 +96,19 @@ void RadioButtonGroup::add(HTMLInputElement* button)
>     else if (!groupIsValid) {
>         // A radio button not in a group is always valid. We need to make it
>         // invalid only if the group is invalid.
>-        button->updateValidity();
>+        button.updateValidity();
>     }
> }
> 
>-void RadioButtonGroup::updateCheckedState(HTMLInputElement* button)
>+void RadioButtonGroup::updateCheckedState(HTMLInputElement& button)
> {
>-    ASSERT(button->isRadioButton());
>-    ASSERT(m_members.contains(button));
>+    ASSERT(button.isRadioButton());
>+    ASSERT(m_members.contains(&button));
>     bool wasValid = isValid();
>-    if (button->checked())
>-        setCheckedButton(button);
>+    if (button.checked())
>+        setCheckedButton(&button);
>     else {
>-        if (m_checkedButton == button)
>+        if (m_checkedButton == &button)
>             setCheckedButton(nullptr);
>     }
>     if (wasValid != isValid())
>@@ -131,22 +130,22 @@ void RadioButtonGroup::requiredStateChanged(HTMLInputElement& button)
>         updateValidityForAllButtons();
> }
> 
>-void RadioButtonGroup::remove(HTMLInputElement* button)
>+void RadioButtonGroup::remove(HTMLInputElement& button)
> {
>-    ASSERT(button->isRadioButton());
>-    HashSet<HTMLInputElement*>::iterator it = m_members.find(button);
>+    ASSERT(button.isRadioButton());
>+    auto it = m_members.find(&button);
>     if (it == m_members.end())
>         return;
> 
>     bool wasValid = isValid();
>     m_members.remove(it);
>-    if (button->isRequired()) {
>+    if (button.isRequired()) {
>         ASSERT(m_requiredCount);
>         --m_requiredCount;
>     }
>     if (m_checkedButton) {
>-        button->invalidateStyleForSubtree();
>-        if (m_checkedButton == button) {
>+        button.invalidateStyleForSubtree();
>+        if (m_checkedButton == &button) {
>             m_checkedButton = nullptr;
>             setNeedsStyleRecalcForAllButtons();
>         }
>@@ -160,7 +159,7 @@ void RadioButtonGroup::remove(HTMLInputElement* button)
>     if (!wasValid) {
>         // A radio button not in a group is always valid. We need to make it
>         // valid only if the group was invalid.
>-        button->updateValidity();
>+        button.updateValidity();
>     }
> }
> 
>@@ -180,9 +179,9 @@ void RadioButtonGroup::updateValidityForAllButtons()
>     }
> }
> 
>-bool RadioButtonGroup::contains(HTMLInputElement* button) const
>+bool RadioButtonGroup::contains(HTMLInputElement& button) const
> {
>-    return m_members.contains(button);
>+    return m_members.contains(&button);
> }
> 
> // ----------------------------------------------------------------
>@@ -194,16 +193,16 @@ RadioButtonGroups::RadioButtonGroups() = default;
> 
> RadioButtonGroups::~RadioButtonGroups() = default;
> 
>-void RadioButtonGroups::addButton(HTMLInputElement* element)
>+void RadioButtonGroups::addButton(HTMLInputElement& element)
> {
>-    ASSERT(element->isRadioButton());
>-    if (element->name().isEmpty())
>+    ASSERT(element.isRadioButton());
>+    if (element.name().isEmpty())
>         return;
> 
>     if (!m_nameToGroupMap)
>         m_nameToGroupMap = std::make_unique<NameToGroupMap>();
> 
>-    auto& group = m_nameToGroupMap->add(element->name().impl(), nullptr).iterator->value;
>+    auto& group = m_nameToGroupMap->add(element.name().impl(), nullptr).iterator->value;
>     if (!group)
>         group = std::make_unique<RadioButtonGroup>();
>     group->add(element);
>@@ -228,17 +227,15 @@ Vector<HTMLInputElement*> RadioButtonGroups::groupMembers(const HTMLInputElement
>     return group->members();
> }
> 
>-void RadioButtonGroups::updateCheckedState(HTMLInputElement* element)
>+void RadioButtonGroups::updateCheckedState(HTMLInputElement& element)
> {
>-    ASSERT(element->isRadioButton());
>-    if (element->name().isEmpty())
>+    ASSERT(element.isRadioButton());
>+    if (element.name().isEmpty())
>         return;
>     ASSERT(m_nameToGroupMap);
>     if (!m_nameToGroupMap)
>         return;
>-    RadioButtonGroup* group = m_nameToGroupMap->get(element->name().impl());
>-    ASSERT(group);
>-    group->updateCheckedState(element);
>+    m_nameToGroupMap->get(element.name().impl())->updateCheckedState(element);
> }
> 
> void RadioButtonGroups::requiredStateChanged(HTMLInputElement& element)
>@@ -263,38 +260,36 @@ HTMLInputElement* RadioButtonGroups::checkedButtonForGroup(const AtomicString& n
>     return group ? group->checkedButton() : nullptr;
> }
> 
>-bool RadioButtonGroups::hasCheckedButton(const HTMLInputElement* element) const
>+bool RadioButtonGroups::hasCheckedButton(const HTMLInputElement& element) const
> {
>-    ASSERT(element->isRadioButton());
>-    const AtomicString& name = element->name();
>+    ASSERT(element.isRadioButton());
>+    const AtomicString& name = element.name();
>     if (name.isEmpty() || !m_nameToGroupMap)
>-        return element->checked();
>-
>-    const RadioButtonGroup* group = m_nameToGroupMap->get(name.impl());
>-    return group->checkedButton();
>+        return element.checked();
>+    return m_nameToGroupMap->get(name.impl())->checkedButton();
> }
> 
>-bool RadioButtonGroups::isInRequiredGroup(HTMLInputElement* element) const
>+bool RadioButtonGroups::isInRequiredGroup(HTMLInputElement& element) const
> {
>-    ASSERT(element->isRadioButton());
>-    if (element->name().isEmpty())
>+    ASSERT(element.isRadioButton());
>+    if (element.name().isEmpty())
>         return false;
>     if (!m_nameToGroupMap)
>         return false;
>-    RadioButtonGroup* group = m_nameToGroupMap->get(element->name().impl());
>+    auto* group = m_nameToGroupMap->get(element.name().impl());
>     return group && group->isRequired() && group->contains(element);
> }
> 
>-void RadioButtonGroups::removeButton(HTMLInputElement* element)
>+void RadioButtonGroups::removeButton(HTMLInputElement& element)
> {
>-    ASSERT(element->isRadioButton());
>-    if (element->name().isEmpty())
>+    ASSERT(element.isRadioButton());
>+    if (element.name().isEmpty())
>         return;
>     if (!m_nameToGroupMap)
>         return;
> 
>     m_nameToGroupMap->checkConsistency();
>-    NameToGroupMap::iterator it = m_nameToGroupMap->find(element->name().impl());
>+    auto it = m_nameToGroupMap->find(element.name().impl());
>     if (it == m_nameToGroupMap->end())
>         return;
>     it->value->remove(element);
>diff --git a/Source/WebCore/dom/RadioButtonGroups.h b/Source/WebCore/dom/RadioButtonGroups.h
>index de8a208c5a5970bc084c5a585763752a29819a14..4b284509142fc23d006c68ead564be4e18683664 100644
>--- a/Source/WebCore/dom/RadioButtonGroups.h
>+++ b/Source/WebCore/dom/RadioButtonGroups.h
>@@ -34,13 +34,13 @@ class RadioButtonGroups {
> public:
>     RadioButtonGroups();
>     ~RadioButtonGroups();
>-    void addButton(HTMLInputElement*);
>-    void updateCheckedState(HTMLInputElement*);
>+    void addButton(HTMLInputElement&);
>+    void updateCheckedState(HTMLInputElement&);
>     void requiredStateChanged(HTMLInputElement&);
>-    void removeButton(HTMLInputElement*);
>+    void removeButton(HTMLInputElement&);
>     HTMLInputElement* checkedButtonForGroup(const AtomicString& groupName) const;
>-    bool hasCheckedButton(const HTMLInputElement*) const;
>-    bool isInRequiredGroup(HTMLInputElement*) const;
>+    bool hasCheckedButton(const HTMLInputElement&) const;
>+    bool isInRequiredGroup(HTMLInputElement&) const;
>     Vector<HTMLInputElement*> groupMembers(const HTMLInputElement&) const;
> 
> private:
>diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
>index 00d6b9fea46272a3ef9e0ecd0fb937845d8e0a66..77c0f831e095ee2224b54b1ebe386d4b8a966b0e 100644
>--- a/Source/WebCore/dom/Range.cpp
>+++ b/Source/WebCore/dom/Range.cpp
>@@ -34,7 +34,6 @@
> #include "Frame.h"
> #include "FrameView.h"
> #include "HTMLBodyElement.h"
>-#include "HTMLDocument.h"
> #include "HTMLElement.h"
> #include "HTMLHtmlElement.h"
> #include "HTMLNames.h"
>@@ -79,7 +78,7 @@ inline Range::Range(Document& ownerDocument)
>     rangeCounter.increment();
> #endif
> 
>-    m_ownerDocument->attachRange(this);
>+    m_ownerDocument->attachRange(*this);
> }
> 
> Ref<Range> Range::create(Document& ownerDocument)
>@@ -96,7 +95,7 @@ inline Range::Range(Document& ownerDocument, Node* startContainer, int startOffs
>     rangeCounter.increment();
> #endif
> 
>-    m_ownerDocument->attachRange(this);
>+    m_ownerDocument->attachRange(*this);
> 
>     // Simply setting the containers and offsets directly would not do any of the checking
>     // that setStart and setEnd do, so we call those functions.
>@@ -125,7 +124,7 @@ Ref<Range> Range::create(Document& ownerDocument, const VisiblePosition& visible
> 
> Range::~Range()
> {
>-    m_ownerDocument->detachRange(this);
>+    m_ownerDocument->detachRange(*this);
> 
> #ifndef NDEBUG
>     rangeCounter.decrement();
>@@ -135,11 +134,11 @@ Range::~Range()
> void Range::setDocument(Document& document)
> {
>     ASSERT(m_ownerDocument.ptr() != &document);
>-    m_ownerDocument->detachRange(this);
>+    m_ownerDocument->detachRange(*this);
>     m_ownerDocument = document;
>     m_start.setToStartOfNode(document);
>     m_end.setToStartOfNode(document);
>-    m_ownerDocument->attachRange(this);
>+    m_ownerDocument->attachRange(*this);
> }
> 
> Node* Range::commonAncestorContainer(Node* containerA, Node* containerB)
>@@ -972,7 +971,7 @@ ExceptionOr<Ref<DocumentFragment>> Range::createContextualFragment(const String&
>         element = &downcast<Element>(node);
>     else
>         element = node.parentElement();
>-    if (!element || (is<HTMLDocument>(element->document()) && is<HTMLHtmlElement>(*element)))
>+    if (!element || (element->document().isHTMLDocument() && is<HTMLHtmlElement>(*element)))
>         element = HTMLBodyElement::create(node.document());
>     return WebCore::createContextualFragment(*element, markup, AllowScriptingContentAndDoNotMarkAlreadyStarted);
> }
>@@ -1664,9 +1663,9 @@ void Range::nodeWillBeRemoved(Node& node)
>     boundaryNodeWillBeRemoved(m_end, node);
> }
> 
>-static inline void boundaryTextInserted(RangeBoundaryPoint& boundary, Node* text, unsigned offset, unsigned length)
>+static inline void boundaryTextInserted(RangeBoundaryPoint& boundary, Node& text, unsigned offset, unsigned length)
> {
>-    if (boundary.container() != text)
>+    if (boundary.container() != &text)
>         return;
>     unsigned boundaryOffset = boundary.offset();
>     if (offset >= boundaryOffset)
>@@ -1674,17 +1673,16 @@ static inline void boundaryTextInserted(RangeBoundaryPoint& boundary, Node* text
>     boundary.setOffset(boundaryOffset + length);
> }
> 
>-void Range::textInserted(Node* text, unsigned offset, unsigned length)
>+void Range::textInserted(Node& text, unsigned offset, unsigned length)
> {
>-    ASSERT(text);
>-    ASSERT(&text->document() == &ownerDocument());
>+    ASSERT(&text.document() == &ownerDocument());
>     boundaryTextInserted(m_start, text, offset, length);
>     boundaryTextInserted(m_end, text, offset, length);
> }
> 
>-static inline void boundaryTextRemoved(RangeBoundaryPoint& boundary, Node* text, unsigned offset, unsigned length)
>+static inline void boundaryTextRemoved(RangeBoundaryPoint& boundary, Node& text, unsigned offset, unsigned length)
> {
>-    if (boundary.container() != text)
>+    if (boundary.container() != &text)
>         return;
>     unsigned boundaryOffset = boundary.offset();
>     if (offset >= boundaryOffset)
>@@ -1695,10 +1693,9 @@ static inline void boundaryTextRemoved(RangeBoundaryPoint& boundary, Node* text,
>         boundary.setOffset(boundaryOffset - length);
> }
> 
>-void Range::textRemoved(Node* text, unsigned offset, unsigned length)
>+void Range::textRemoved(Node& text, unsigned offset, unsigned length)
> {
>-    ASSERT(text);
>-    ASSERT(&text->document() == &ownerDocument());
>+    ASSERT(&text.document() == &ownerDocument());
>     boundaryTextRemoved(m_start, text, offset, length);
>     boundaryTextRemoved(m_end, text, offset, length);
> }
>@@ -1723,15 +1720,15 @@ void Range::textNodesMerged(NodeWithIndex& oldNode, unsigned offset)
>     boundaryTextNodesMerged(m_end, oldNode, offset);
> }
> 
>-static inline void boundaryTextNodesSplit(RangeBoundaryPoint& boundary, Text* oldNode)
>+static inline void boundaryTextNodesSplit(RangeBoundaryPoint& boundary, Text& oldNode)
> {
>-    auto* parent = oldNode->parentNode();
>-    if (boundary.container() == oldNode) {
>-        unsigned splitOffset = oldNode->length();
>+    auto* parent = oldNode.parentNode();
>+    if (boundary.container() == &oldNode) {
>+        unsigned splitOffset = oldNode.length();
>         unsigned boundaryOffset = boundary.offset();
>         if (boundaryOffset > splitOffset) {
>             if (parent)
>-                boundary.set(*oldNode->nextSibling(), boundaryOffset - splitOffset, 0);
>+                boundary.set(*oldNode.nextSibling(), boundaryOffset - splitOffset, 0);
>             else
>                 boundary.setOffset(splitOffset);
>         }
>@@ -1739,20 +1736,18 @@ static inline void boundaryTextNodesSplit(RangeBoundaryPoint& boundary, Text* ol
>     }
>     if (!parent)
>         return;
>-    if (boundary.container() == parent && boundary.childBefore() == oldNode) {
>-        auto* newChild = oldNode->nextSibling();
>+    if (boundary.container() == parent && boundary.childBefore() == &oldNode) {
>+        auto* newChild = oldNode.nextSibling();
>         ASSERT(newChild);
>         boundary.setToAfterChild(*newChild);
>     }
> }
> 
>-void Range::textNodeSplit(Text* oldNode)
>+void Range::textNodeSplit(Text& oldNode)
> {
>-    ASSERT(oldNode);
>-    ASSERT(&oldNode->document() == &ownerDocument());
>-    ASSERT(oldNode->isTextNode());
>-    ASSERT(!oldNode->parentNode() || oldNode->nextSibling());
>-    ASSERT(!oldNode->parentNode() || oldNode->nextSibling()->isTextNode());
>+    ASSERT(&oldNode.document() == &ownerDocument());
>+    ASSERT(!oldNode.parentNode() || oldNode.nextSibling());
>+    ASSERT(!oldNode.parentNode() || oldNode.nextSibling()->isTextNode());
>     boundaryTextNodesSplit(m_start, oldNode);
>     boundaryTextNodesSplit(m_end, oldNode);
> }
>diff --git a/Source/WebCore/dom/Range.h b/Source/WebCore/dom/Range.h
>index 98c1644ead5c123ea092c72ffbf9a56d87939a44..f6c441a8beaf345f88b970dbfcfc330694d00fda 100644
>--- a/Source/WebCore/dom/Range.h
>+++ b/Source/WebCore/dom/Range.h
>@@ -132,10 +132,10 @@ public:
>     void nodeChildrenWillBeRemoved(ContainerNode&);
>     void nodeWillBeRemoved(Node&);
> 
>-    void textInserted(Node*, unsigned offset, unsigned length);
>-    void textRemoved(Node*, unsigned offset, unsigned length);
>+    void textInserted(Node&, unsigned offset, unsigned length);
>+    void textRemoved(Node&, unsigned offset, unsigned length);
>     void textNodesMerged(NodeWithIndex& oldNode, unsigned offset);
>-    void textNodeSplit(Text* oldNode);
>+    void textNodeSplit(Text& oldNode);
> 
>     // Expand range to a unit (word or sentence or block or document) boundary.
>     // Please refer to https://bugs.webkit.org/show_bug.cgi?id=27632 comment #5 
>diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
>index 0b7db0b7238c32afe3ca4b6fb28726be69b5b74f..063d64d2518518d27580f2d2dafaeca6c6c93d9d 100644
>--- a/Source/WebCore/dom/ScriptElement.cpp
>+++ b/Source/WebCore/dom/ScriptElement.cpp
>@@ -252,11 +252,11 @@ bool ScriptElement::prepareScript(const TextPosition& scriptStartPosition, Legac
>     } else if ((isClassicExternalScript || scriptType == ScriptType::Module) && !hasAsyncAttribute() && !m_forceAsync) {
>         m_willExecuteInOrder = true;
>         ASSERT(m_loadableScript);
>-        document.scriptRunner()->queueScriptForExecution(*this, *m_loadableScript, ScriptRunner::IN_ORDER_EXECUTION);
>+        document.scriptRunner().queueScriptForExecution(*this, *m_loadableScript, ScriptRunner::IN_ORDER_EXECUTION);
>     } else if (hasSourceAttribute() || scriptType == ScriptType::Module) {
>         ASSERT(m_loadableScript);
>         ASSERT(hasAsyncAttribute() || m_forceAsync);
>-        document.scriptRunner()->queueScriptForExecution(*this, *m_loadableScript, ScriptRunner::ASYNC_EXECUTION);
>+        document.scriptRunner().queueScriptForExecution(*this, *m_loadableScript, ScriptRunner::ASYNC_EXECUTION);
>     } else if (!hasSourceAttribute() && m_parserInserted && !document.haveStylesheetsLoaded()) {
>         ASSERT(scriptType == ScriptType::Classic);
>         m_willBeParserExecuted = true;
>diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
>index 50f292b07f475e2608aecb78c2ba5016a443ad7b..050d169b4ffa5b3100cca4ce10fa185e921ec598 100644
>--- a/Source/WebCore/dom/Text.cpp
>+++ b/Source/WebCore/dom/Text.cpp
>@@ -73,7 +73,7 @@ ExceptionOr<Ref<Text>> Text::splitText(unsigned offset)
>             return insertResult.releaseException();
>     }
> 
>-    document().textNodeSplit(this);
>+    document().textNodeSplit(*this);
> 
>     if (renderer())
>         renderer()->setTextWithOffset(data(), 0, oldData.length());
>diff --git a/Source/WebCore/dom/UserActionElementSet.h b/Source/WebCore/dom/UserActionElementSet.h
>index 1fa6b3d1ef2d2b8f4d991199f047c5e5e29c6516..e73f0e2125e503792a4a8b05bf23971633ae5711 100644
>--- a/Source/WebCore/dom/UserActionElementSet.h
>+++ b/Source/WebCore/dom/UserActionElementSet.h
>@@ -27,6 +27,7 @@
> 
> #pragma once
> 
>+#include <wtf/Forward.h>
> #include <wtf/HashMap.h>
> #include <wtf/OptionSet.h>
> #include <wtf/Ref.h>
>@@ -40,7 +41,7 @@ public:
>     bool isActive(const Element& element) { return hasFlag(element, Flag::IsActive); }
>     bool isFocused(const Element& element) { return hasFlag(element, Flag::IsFocused); }
>     bool isHovered(const Element& element) { return hasFlag(element, Flag::IsHovered); }
>-    bool inActiveChain(const Element& element) { return hasFlag(element, Flag::InActiveChain); }
>+    bool isInActiveChain(const Element& element) { return hasFlag(element, Flag::InActiveChain); }
> 
>     void setActive(Element& element, bool enable) { setFlags(element, enable, Flag::IsActive); }
>     void setFocused(Element& element, bool enable) { setFlags(element, enable, Flag::IsFocused); }
>diff --git a/Source/WebCore/editing/AlternativeTextController.cpp b/Source/WebCore/editing/AlternativeTextController.cpp
>index 516d76ea4d17ad8334fcfa883d74992cf39b7f71..2b75bd67b575446bc0f3ccbe4058baaf6fc58120 100644
>--- a/Source/WebCore/editing/AlternativeTextController.cpp
>+++ b/Source/WebCore/editing/AlternativeTextController.cpp
>@@ -234,7 +234,7 @@ void AlternativeTextController::applyAlternativeTextToRange(const Range& range,
>     DocumentMarkerController& markers = replacementRange->startContainer().document().markers();
> 
>     for (auto markerType : markerTypesToAdd)
>-        markers.addMarker(replacementRange.get(), markerType, markerDescriptionForAppliedAlternativeText(alternativeType, markerType));
>+        markers.addMarker(*replacementRange, markerType, markerDescriptionForAppliedAlternativeText(alternativeType, markerType));
> }
> 
> bool AlternativeTextController::applyAutocorrectionBeforeTypingIfAppropriate()
>@@ -268,10 +268,10 @@ void AlternativeTextController::respondToUnappliedSpellCorrection(const VisibleS
>     m_frame.selection().setSelection(selectionOfCorrected, FrameSelection::defaultSetSelectionOptions() | FrameSelection::SpellCorrectionTriggered);
>     auto range = Range::create(*m_frame.document(), m_frame.selection().selection().start(), m_frame.selection().selection().end());
> 
>-    DocumentMarkerController& markers = m_frame.document()->markers();
>-    markers.removeMarkers(range.ptr(), OptionSet<DocumentMarker::MarkerType> { DocumentMarker::Spelling, DocumentMarker::Autocorrected }, DocumentMarkerController::RemovePartiallyOverlappingMarker);
>-    markers.addMarker(range.ptr(), DocumentMarker::Replacement);
>-    markers.addMarker(range.ptr(), DocumentMarker::SpellCheckingExemption);
>+    auto& markers = m_frame.document()->markers();
>+    markers.removeMarkers(range, OptionSet<DocumentMarker::MarkerType> { DocumentMarker::Spelling, DocumentMarker::Autocorrected }, DocumentMarkerController::RemovePartiallyOverlappingMarker);
>+    markers.addMarker(range, DocumentMarker::Replacement);
>+    markers.addMarker(range, DocumentMarker::SpellCheckingExemption);
> }
> 
> void AlternativeTextController::timerFired()
>@@ -360,7 +360,7 @@ void AlternativeTextController::handleAlternativeTextUIResult(const String& resu
>         if (result.length())
>             applyAlternativeTextToRange(*rangeWithAlternative, result, m_type, markerTypesForAutocorrection());
>         else if (!m_isDismissedByEditing)
>-            rangeWithAlternative->startContainer().document().markers().addMarker(rangeWithAlternative, DocumentMarker::RejectedCorrection, m_originalText);
>+            rangeWithAlternative->startContainer().document().markers().addMarker(*rangeWithAlternative, DocumentMarker::RejectedCorrection, m_originalText);
>         break;
>     case AlternativeTextTypeReversion:
>     case AlternativeTextTypeSpellingSuggestions:
>@@ -444,9 +444,9 @@ void AlternativeTextController::respondToUnappliedEditing(EditCommandComposition
>     if (!command->wasCreateLinkCommand())
>         return;
>     auto range = Range::create(*m_frame.document(), command->startingSelection().start(), command->startingSelection().end());
>-    DocumentMarkerController& markers = m_frame.document()->markers();
>-    markers.addMarker(range.ptr(), DocumentMarker::Replacement);
>-    markers.addMarker(range.ptr(), DocumentMarker::SpellCheckingExemption);
>+    auto& markers = m_frame.document()->markers();
>+    markers.addMarker(range, DocumentMarker::Replacement);
>+    markers.addMarker(range, DocumentMarker::SpellCheckingExemption);
> }
> 
> AlternativeTextClient* AlternativeTextController::alternativeTextClient()
>@@ -474,8 +474,8 @@ void AlternativeTextController::recordAutocorrectionResponse(AutocorrectionRespo
> 
> void AlternativeTextController::markReversed(Range& changedRange)
> {
>-    changedRange.startContainer().document().markers().removeMarkers(&changedRange, DocumentMarker::Autocorrected, DocumentMarkerController::RemovePartiallyOverlappingMarker);
>-    changedRange.startContainer().document().markers().addMarker(&changedRange, DocumentMarker::SpellCheckingExemption);
>+    changedRange.startContainer().document().markers().removeMarkers(changedRange, DocumentMarker::Autocorrected, DocumentMarkerController::RemovePartiallyOverlappingMarker);
>+    changedRange.startContainer().document().markers().addMarker(changedRange, DocumentMarker::SpellCheckingExemption);
> }
> 
> void AlternativeTextController::markCorrection(Range& replacedRange, const String& replacedString)
>@@ -483,9 +483,9 @@ void AlternativeTextController::markCorrection(Range& replacedRange, const Strin
>     DocumentMarkerController& markers = replacedRange.startContainer().document().markers();
>     for (auto markerType : markerTypesForAutocorrection()) {
>         if (markerType == DocumentMarker::Replacement || markerType == DocumentMarker::Autocorrected)
>-            markers.addMarker(&replacedRange, markerType, replacedString);
>+            markers.addMarker(replacedRange, markerType, replacedString);
>         else
>-            markers.addMarker(&replacedRange, markerType);
>+            markers.addMarker(replacedRange, markerType);
>     }
> }
> 
>@@ -505,7 +505,7 @@ void AlternativeTextController::recordSpellcheckerResponseForModifiedCorrection(
>             client->recordAutocorrectionResponse(AutocorrectionResponse::Edited, corrected, correction);
>     }
> 
>-    markers.removeMarkers(&rangeOfCorrection, DocumentMarker::Autocorrected, DocumentMarkerController::RemovePartiallyOverlappingMarker);
>+    markers.removeMarkers(rangeOfCorrection, DocumentMarker::Autocorrected, DocumentMarkerController::RemovePartiallyOverlappingMarker);
> }
> 
> void AlternativeTextController::deletedAutocorrectionAtPosition(const Position& position, const String& originalString)
>@@ -532,7 +532,7 @@ void AlternativeTextController::markPrecedingWhitespaceForDeletedAutocorrectionA
>     // Mark this whitespace to indicate we have deleted an autocorrection following this
>     // whitespace. So if the user types the same original word again at this position, we
>     // won't autocorrect it again.
>-    m_frame.document()->markers().addMarker(precedingCharacterRange.ptr(), DocumentMarker::DeletedAutocorrection, m_originalStringForLastDeletedAutocorrection);
>+    m_frame.document()->markers().addMarker(precedingCharacterRange, DocumentMarker::DeletedAutocorrection, m_originalStringForLastDeletedAutocorrection);
> }
> 
> bool AlternativeTextController::processMarkersOnTextToBeReplacedByResult(const TextCheckingResult& result, Range& rangeWithAlternative, const String& stringToBeReplaced)
>diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
>index d7f6775e9d423a276e1d287909c36bbc7bf5e55b..242bd985cf620e4326f572cfb94594564dd5f9c5 100644
>--- a/Source/WebCore/editing/CompositeEditCommand.cpp
>+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
>@@ -771,11 +771,11 @@ void CompositeEditCommand::replaceTextInNodePreservingMarkers(Text& node, unsign
>     for (const auto& marker : markers) {
> #if PLATFORM(IOS_FAMILY)
>         if (marker.isDictation()) {
>-            markerController.addMarker(newRange.ptr(), marker.type(), marker.description(), marker.alternatives(), marker.metadata());
>+            markerController.addMarker(newRange, marker.type(), marker.description(), marker.alternatives(), marker.metadata());
>             continue;
>         }
> #endif
>-        markerController.addMarker(newRange.ptr(), marker.type(), marker.description());
>+        markerController.addMarker(newRange, marker.type(), marker.description());
>     }
> }
> 
>diff --git a/Source/WebCore/editing/DictationCommand.cpp b/Source/WebCore/editing/DictationCommand.cpp
>index 975d41b45a9b76c622b2db9eec6ab46dc2649f76..adf744fc5c311fcf65c6fd7a351ef6300081b971 100644
>--- a/Source/WebCore/editing/DictationCommand.cpp
>+++ b/Source/WebCore/editing/DictationCommand.cpp
>@@ -61,9 +61,9 @@ public:
>         return adoptRef(*new DictationMarkerSupplier(alternatives));
>     }
> 
>-    void addMarkersToTextNode(Text* textNode, unsigned offsetOfInsertion, const String& textToBeInserted) override
>+    void addMarkersToTextNode(Text& textNode, unsigned offsetOfInsertion, const String& textToBeInserted) override
>     {
>-        auto& markerController = textNode->document().markers();
>+        auto& markerController = textNode.document().markers();
>         for (auto& alternative : m_alternatives) {
>             DocumentMarker::DictationData data { alternative.dictationContext, textToBeInserted.substring(alternative.rangeStart, alternative.rangeLength) };
>             markerController.addMarkerToNode(textNode, alternative.rangeStart + offsetOfInsertion, alternative.rangeLength, DocumentMarker::DictationAlternatives, WTFMove(data));
>diff --git a/Source/WebCore/editing/Editing.cpp b/Source/WebCore/editing/Editing.cpp
>index 86d021d18a47913eea0b76648ef9ff9cf042d5d2..6e3ccf7ed903c55951a8a98af017435143eaf75e 100644
>--- a/Source/WebCore/editing/Editing.cpp
>+++ b/Source/WebCore/editing/Editing.cpp
>@@ -1165,7 +1165,7 @@ bool areIdenticalElements(const Node& first, const Node& second)
>         return false;
>     auto& firstElement = downcast<Element>(first);
>     auto& secondElement = downcast<Element>(second);
>-    return firstElement.hasTagName(secondElement.tagQName()) && firstElement.hasEquivalentAttributes(&secondElement);
>+    return firstElement.hasTagName(secondElement.tagQName()) && firstElement.hasEquivalentAttributes(secondElement);
> }
> 
> bool isNonTableCellHTMLBlockElement(const Node* node)
>diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
>index 5854aeb55a0f24d85855eed1260e3e3d94eaf0a3..37556426af1ee0c4688fe32d18c8ab0cbc358445 100644
>--- a/Source/WebCore/editing/Editor.cpp
>+++ b/Source/WebCore/editing/Editor.cpp
>@@ -2044,7 +2044,7 @@ void Editor::ignoreSpelling()
>         
>     RefPtr<Range> selectedRange = m_frame.selection().toNormalizedRange();
>     if (selectedRange)
>-        document().markers().removeMarkers(selectedRange.get(), DocumentMarker::Spelling);
>+        document().markers().removeMarkers(*selectedRange, DocumentMarker::Spelling);
> 
>     String text = selectedText();
>     ASSERT(text.length());
>@@ -2060,7 +2060,7 @@ void Editor::learnSpelling()
> 
>     RefPtr<Range> selectedRange = m_frame.selection().toNormalizedRange();
>     if (selectedRange)
>-        document().markers().removeMarkers(selectedRange.get(), DocumentMarker::Spelling);
>+        document().markers().removeMarkers(*selectedRange, DocumentMarker::Spelling);
> 
>     String text = selectedText();
>     ASSERT(text.length());
>@@ -2226,12 +2226,12 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
>         ASSERT(grammarDetail.location != -1 && grammarDetail.length > 0);
>         
>         // FIXME 4859190: This gets confused with doubled punctuation at the end of a paragraph
>-        RefPtr<Range> badGrammarRange = TextIterator::subrange(*grammarSearchRange, grammarPhraseOffset + grammarDetail.location, grammarDetail.length);
>-        m_frame.selection().setSelection(VisibleSelection(*badGrammarRange, SEL_DEFAULT_AFFINITY));
>+        auto badGrammarRange = TextIterator::subrange(*grammarSearchRange, grammarPhraseOffset + grammarDetail.location, grammarDetail.length);
>+        m_frame.selection().setSelection(VisibleSelection(badGrammarRange, SEL_DEFAULT_AFFINITY));
>         m_frame.selection().revealSelection();
>         
>         client()->updateSpellingUIWithGrammarString(badGrammarPhrase, grammarDetail);
>-        document().markers().addMarker(badGrammarRange.get(), DocumentMarker::Grammar, grammarDetail.userDescription);
>+        document().markers().addMarker(badGrammarRange, DocumentMarker::Grammar, grammarDetail.userDescription);
>     } else
> #endif
>     if (!misspelledWord.isEmpty()) {
>@@ -2243,7 +2243,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
>         m_frame.selection().revealSelection();
>         
>         client()->updateSpellingUIWithMisspelledWord(misspelledWord);
>-        document().markers().addMarker(misspellingRange.ptr(), DocumentMarker::Spelling);
>+        document().markers().addMarker(misspellingRange, DocumentMarker::Spelling);
>     }
> }
> 
>@@ -2378,13 +2378,10 @@ bool Editor::spellingPanelIsShowing()
>     return client()->spellingUIIsShowing();
> }
> 
>-void Editor::clearMisspellingsAndBadGrammar(const VisibleSelection &movingSelection)
>+void Editor::clearMisspellingsAndBadGrammar(const VisibleSelection& movingSelection)
> {
>-    RefPtr<Range> selectedRange = movingSelection.toNormalizedRange();
>-    if (selectedRange) {
>-        document().markers().removeMarkers(selectedRange.get(), DocumentMarker::Spelling);
>-        document().markers().removeMarkers(selectedRange.get(), DocumentMarker::Grammar);
>-    }
>+    if (auto selectedRange = movingSelection.toNormalizedRange())
>+        document().markers().removeMarkers(*selectedRange, { DocumentMarker::Spelling, DocumentMarker::Grammar });
> }
> 
> void Editor::markMisspellingsAndBadGrammar(const VisibleSelection &movingSelection)
>@@ -2490,8 +2487,8 @@ void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart,
>         // cause any other part of the current sentence to lose or gain spelling correction markers, due to
>         // sentence retro correction. As such, we expand the spell checking range to encompass as much of the
>         // full sentence as we can, respecting boundaries where spellchecking is disabled.
>-        fullSentenceRange->ownerDocument().markers().removeMarkers(fullSentenceRange.get(), DocumentMarker::Grammar);
>-        spellCheckingRange->ownerDocument().markers().removeMarkers(spellCheckingRange.get(), DocumentMarker::Spelling);
>+        fullSentenceRange->ownerDocument().markers().removeMarkers(*fullSentenceRange, DocumentMarker::Grammar);
>+        spellCheckingRange->ownerDocument().markers().removeMarkers(*spellCheckingRange, DocumentMarker::Spelling);
>         markAllMisspellingsAndBadGrammarInRanges(textCheckingOptions, WTFMove(spellCheckingRange), WTFMove(adjacentWordRange), WTFMove(fullSentenceRange));
>         return;
>     }
>@@ -2761,14 +2758,14 @@ void Editor::markAndReplaceFor(const SpellCheckRequest& request, const Vector<Te
>             auto misspellingRange = paragraph.subrange(resultLocation, resultLength);
>             if (!m_alternativeTextController->isSpellingMarkerAllowed(misspellingRange))
>                 continue;
>-            misspellingRange->startContainer().document().markers().addMarker(misspellingRange.ptr(), DocumentMarker::Spelling, replacement);
>+            misspellingRange->startContainer().document().markers().addMarker(misspellingRange, DocumentMarker::Spelling, replacement);
>         } else if (shouldMarkGrammar && resultType == TextCheckingType::Grammar && paragraph.checkingRangeCovers(resultLocation, resultLength)) {
>             ASSERT(resultLength > 0 && resultLocation >= 0);
>             for (auto& detail : results[i].details) {
>                 ASSERT(detail.length > 0 && detail.location >= 0);
>                 if (paragraph.checkingRangeCovers(resultLocation + detail.location, detail.length)) {
>                     auto badGrammarRange = paragraph.subrange(resultLocation + detail.location, detail.length);
>-                    badGrammarRange->startContainer().document().markers().addMarker(badGrammarRange.ptr(), DocumentMarker::Grammar, detail.userDescription);
>+                    badGrammarRange->startContainer().document().markers().addMarker(badGrammarRange, DocumentMarker::Grammar, detail.userDescription);
>                 }
>             }
>         } else if (resultEndLocation <= automaticReplacementEndLocation && resultEndLocation >= paragraph.automaticReplacementStart()
>@@ -2882,7 +2879,7 @@ void Editor::changeBackToReplacedString(const String& replacedString)
>     TextCheckingParagraph paragraph(*selection);
>     replaceSelectionWithText(replacedString, SelectReplacement::No, SmartReplace::No, EditAction::Insert);
>     auto changedRange = paragraph.subrange(paragraph.checkingStart(), replacedString.length());
>-    changedRange->startContainer().document().markers().addMarker(changedRange.ptr(), DocumentMarker::Replacement, String());
>+    changedRange->startContainer().document().markers().addMarker(changedRange, DocumentMarker::Replacement, String());
>     m_alternativeTextController->markReversed(changedRange);
> #else
>     ASSERT_NOT_REACHED();
>@@ -2998,7 +2995,7 @@ void Editor::updateMarkersForWordsAffectedByEditing(bool doNotRemoveIfSelectionA
>         DocumentMarker::Grammar,
> #endif
>     };
>-    document().markers().removeMarkers(wordRange.ptr(), markerTypesToRemove, DocumentMarkerController::RemovePartiallyOverlappingMarker);
>+    document().markers().removeMarkers(wordRange, markerTypesToRemove, DocumentMarkerController::RemovePartiallyOverlappingMarker);
>     document().markers().clearDescriptionOnMarkersIntersectingRange(wordRange, DocumentMarker::Replacement);
> }
> 
>@@ -3490,7 +3487,7 @@ unsigned Editor::countMatchesForText(const String& target, Range* range, FindOpt
> 
>     unsigned matchCount = 0;
>     do {
>-        RefPtr<Range> resultRange(findPlainText(*searchRange, target, options - Backwards));
>+        auto resultRange = findPlainText(*searchRange, target, options - Backwards);
>         if (resultRange->collapsed()) {
>             if (!resultRange->startContainer().isInShadowTree())
>                 break;
>@@ -3502,10 +3499,10 @@ unsigned Editor::countMatchesForText(const String& target, Range* range, FindOpt
> 
>         ++matchCount;
>         if (matches)
>-            matches->append(resultRange);
>+            matches->append(resultRange.ptr());
>         
>         if (markMatches)
>-            document().markers().addMarker(resultRange.get(), DocumentMarker::TextMatch);
>+            document().markers().addMarker(resultRange, DocumentMarker::TextMatch);
> 
>         // Stop looking if we hit the specified limit. A limit of 0 means no limit.
>         if (limit > 0 && matchCount >= limit)
>@@ -3654,10 +3651,10 @@ void Editor::scanRangeForTelephoneNumbers(Range& range, const StringView& string
>         unsigned subrangeOffset = scannerPosition + relativeStartPosition;
>         unsigned subrangeLength = relativeEndPosition - relativeStartPosition + 1;
> 
>-        RefPtr<Range> subrange = TextIterator::subrange(range, subrangeOffset, subrangeLength);
>+        auto subrange = TextIterator::subrange(range, subrangeOffset, subrangeLength);
> 
>-        markedRanges.append(subrange);
>-        range.ownerDocument().markers().addMarker(subrange.get(), DocumentMarker::TelephoneNumber);
>+        markedRanges.append(subrange.ptr());
>+        range.ownerDocument().markers().addMarker(subrange, DocumentMarker::TelephoneNumber);
> 
>         scannerPosition += relativeEndPosition + 1;
>     }
>@@ -3722,11 +3719,11 @@ void Editor::editorUIUpdateTimerFired()
> 
>         if (!textChecker() || textChecker()->shouldEraseMarkersAfterChangeSelection(TextCheckingType::Spelling)) {
>             if (RefPtr<Range> wordRange = newAdjacentWords.toNormalizedRange())
>-                document().markers().removeMarkers(wordRange.get(), DocumentMarker::Spelling);
>+                document().markers().removeMarkers(*wordRange, DocumentMarker::Spelling);
>         }
>         if (!textChecker() || textChecker()->shouldEraseMarkersAfterChangeSelection(TextCheckingType::Grammar)) {
>             if (RefPtr<Range> sentenceRange = newSelectedSentence.toNormalizedRange())
>-                document().markers().removeMarkers(sentenceRange.get(), DocumentMarker::Grammar);
>+                document().markers().removeMarkers(*sentenceRange, DocumentMarker::Grammar);
>         }
>     }
> 
>@@ -4122,7 +4119,7 @@ void Editor::handleAcceptedCandidate(TextCheckingResult acceptedCandidate)
> 
>     RefPtr<Range> insertedCandidateRange = rangeExpandedByCharactersInDirectionAtWordBoundary(selection.visibleStart(), acceptedCandidate.replacement.length(), DirectionBackward);
>     if (insertedCandidateRange)
>-        insertedCandidateRange->startContainer().document().markers().addMarker(insertedCandidateRange.get(), DocumentMarker::AcceptedCandidate, acceptedCandidate.replacement);
>+        insertedCandidateRange->startContainer().document().markers().addMarker(*insertedCandidateRange, DocumentMarker::AcceptedCandidate, acceptedCandidate.replacement);
> 
>     m_isHandlingAcceptedCandidate = false;
> }
>diff --git a/Source/WebCore/editing/InsertTextCommand.cpp b/Source/WebCore/editing/InsertTextCommand.cpp
>index efd86509a15e6c58dbc9a70f1990bf6f5902fdc2..fbcd2fffaeeed4526901357ca6358c22a1ca44a1 100644
>--- a/Source/WebCore/editing/InsertTextCommand.cpp
>+++ b/Source/WebCore/editing/InsertTextCommand.cpp
>@@ -206,7 +206,7 @@ void InsertTextCommand::doApply()
>         insertTextIntoNode(*textNode, offset, m_text);
>         endPosition = Position(textNode.get(), offset + m_text.length());
>         if (m_markerSupplier)
>-            m_markerSupplier->addMarkersToTextNode(textNode.get(), offset, m_text);
>+            m_markerSupplier->addMarkersToTextNode(*textNode, offset, m_text);
> 
>         if (m_rebalanceType == RebalanceLeadingAndTrailingWhitespaces) {
>             // The insertion may require adjusting adjacent whitespace, if it is present.
>diff --git a/Source/WebCore/editing/InsertTextCommand.h b/Source/WebCore/editing/InsertTextCommand.h
>index 2c3bcc4f30f0c68f35679eea0d2faf05b3b598e1..18fd677eb2a971663ac793214bccb4bc8f52c05f 100644
>--- a/Source/WebCore/editing/InsertTextCommand.h
>+++ b/Source/WebCore/editing/InsertTextCommand.h
>@@ -35,7 +35,7 @@ class Text;
> class TextInsertionMarkerSupplier : public RefCounted<TextInsertionMarkerSupplier> {
> public:
>     virtual ~TextInsertionMarkerSupplier() = default;
>-    virtual void addMarkersToTextNode(Text*, unsigned offsetOfInsertion, const String& textInserted) = 0;
>+    virtual void addMarkersToTextNode(Text&, unsigned offsetOfInsertion, const String& textInserted) = 0;
> protected:
>     TextInsertionMarkerSupplier() = default;
> };
>diff --git a/Source/WebCore/editing/SpellChecker.cpp b/Source/WebCore/editing/SpellChecker.cpp
>index 604e740579bb0adb9580486ce24fd7020a35c474..3ed480aea9a0e24c61251d2974e23cbc129e2bdd 100644
>--- a/Source/WebCore/editing/SpellChecker.cpp
>+++ b/Source/WebCore/editing/SpellChecker.cpp
>@@ -222,7 +222,7 @@ void SpellChecker::didCheckSucceed(int sequence, const Vector<TextCheckingResult
>         if (requestData.checkingTypes().contains(TextCheckingType::Grammar))
>             markerTypes.add(DocumentMarker::Grammar);
>         if (!markerTypes.isEmpty())
>-            m_frame.document()->markers().removeMarkers(&m_processingRequest->checkingRange(), markerTypes);
>+            m_frame.document()->markers().removeMarkers(m_processingRequest->checkingRange(), markerTypes);
>     }
>     didCheck(sequence, results);
> }
>diff --git a/Source/WebCore/editing/SplitTextNodeCommand.cpp b/Source/WebCore/editing/SplitTextNodeCommand.cpp
>index 9ad090f08f74709cad11758a57464b98ae04a0a5..9b776102f9f15ac96689938097cb22eea2fd0bb9 100644
>--- a/Source/WebCore/editing/SplitTextNodeCommand.cpp
>+++ b/Source/WebCore/editing/SplitTextNodeCommand.cpp
>@@ -62,7 +62,7 @@ void SplitTextNodeCommand::doApply()
> 
>     m_text1 = Text::create(document(), WTFMove(prefixText));
>     ASSERT(m_text1);
>-    document().markers().copyMarkers(m_text2.ptr(), 0, m_offset, m_text1.get(), 0);
>+    document().markers().copyMarkers(m_text2, 0, m_offset, *m_text1, 0);
> 
>     insertText1AndTrimText2();
> }
>@@ -78,7 +78,7 @@ void SplitTextNodeCommand::doUnapply()
> 
>     m_text2->insertData(0, prefixText);
> 
>-    document().markers().copyMarkers(m_text1.get(), 0, prefixText.length(), m_text2.ptr(), 0);
>+    document().markers().copyMarkers(*m_text1, 0, prefixText.length(), m_text2, 0);
>     m_text1->remove();
> }
> 
>diff --git a/Source/WebCore/editing/TextCheckingHelper.cpp b/Source/WebCore/editing/TextCheckingHelper.cpp
>index e89e870a56b70946c7ad7ebbc1ce95140c520e47..104ca3897ac2c609c7a8945e850227ba365c1847 100644
>--- a/Source/WebCore/editing/TextCheckingHelper.cpp
>+++ b/Source/WebCore/editing/TextCheckingHelper.cpp
>@@ -277,17 +277,17 @@ String TextCheckingHelper::findFirstMisspelling(int& firstMisspellingOffset, boo
> 
>         if (misspellingLocation >= 0 && misspellingLength > 0 && misspellingLocation < textLength && misspellingLength <= textLength && misspellingLocation + misspellingLength <= textLength) {
>             // Compute range of misspelled word
>-            RefPtr<Range> misspellingRange = TextIterator::subrange(m_range, currentChunkOffset + misspellingLocation, misspellingLength);
>+            auto misspellingRange = TextIterator::subrange(m_range, currentChunkOffset + misspellingLocation, misspellingLength);
> 
>             // Remember first-encountered misspelling and its offset.
>             if (!firstMisspelling) {
>                 firstMisspellingOffset = currentChunkOffset + misspellingLocation;
>                 firstMisspelling = text.substring(misspellingLocation, misspellingLength).toString();
>-                firstMisspellingRange = misspellingRange;
>+                firstMisspellingRange = misspellingRange.ptr();
>             }
> 
>             // Store marker for misspelled word.
>-            misspellingRange->startContainer().document().markers().addMarker(misspellingRange.get(), DocumentMarker::Spelling);
>+            misspellingRange->startContainer().document().markers().addMarker(misspellingRange, DocumentMarker::Spelling);
> 
>             // Bail out if we're marking only the first misspelling, and not all instances.
>             if (!markAll)
>@@ -453,8 +453,8 @@ int TextCheckingHelper::findFirstGrammarDetail(const Vector<GrammarDetail>& gram
>             continue;
>         
>         if (markAll) {
>-            RefPtr<Range> badGrammarRange = TextIterator::subrange(m_range, badGrammarPhraseLocation - startOffset + detail->location, detail->length);
>-            badGrammarRange->startContainer().document().markers().addMarker(badGrammarRange.get(), DocumentMarker::Grammar, detail->userDescription);
>+            auto badGrammarRange = TextIterator::subrange(m_range, badGrammarPhraseLocation - startOffset + detail->location, detail->length);
>+            badGrammarRange->startContainer().document().markers().addMarker(badGrammarRange, DocumentMarker::Grammar, detail->userDescription);
>         }
>         
>         // Remember this detail only if it's earlier than our current candidate (the details aren't in a guaranteed order)
>diff --git a/Source/WebCore/editing/ios/DictationCommandIOS.cpp b/Source/WebCore/editing/ios/DictationCommandIOS.cpp
>index 2c4b60d014331115cb912c70ed9fcc5b2534f3bd..9c1ae888951fb3bb256ed7e09e24176bc8d3c389 100644
>--- a/Source/WebCore/editing/ios/DictationCommandIOS.cpp
>+++ b/Source/WebCore/editing/ios/DictationCommandIOS.cpp
>@@ -57,7 +57,7 @@ void DictationCommandIOS::doApply()
>         inputText(firstInterpretation, true);
> 
>         if (interpretations.size() > 1)
>-            document().markers().addDictationPhraseWithAlternativesMarker(endingSelection().toNormalizedRange().get(), interpretations);
>+            document().markers().addDictationPhraseWithAlternativesMarker(*endingSelection().toNormalizedRange(), interpretations);
> 
>         setEndingSelection(VisibleSelection(endingSelection().visibleEnd()));
>     }
>@@ -73,7 +73,8 @@ void DictationCommandIOS::doApply()
> 
>     if (startIndex >= 0) {
>         RefPtr<Range> resultRange = TextIterator::rangeFromLocationAndLength(document().documentElement(), startIndex, endIndex, true);
>-        document().markers().addDictationResultMarker(resultRange.get(), m_metadata);
>+        ASSERT(resultRange); // FIXME: What guarantees this?
>+        document().markers().addDictationResultMarker(*resultRange, m_metadata);
>     }
> }
> 
>diff --git a/Source/WebCore/editing/ios/EditorIOS.mm b/Source/WebCore/editing/ios/EditorIOS.mm
>index 230f5e3b41732b1e6284509d1445587da3df2910..985addd77b8d79b7e100febf9ddc8b4c5c55dde4 100644
>--- a/Source/WebCore/editing/ios/EditorIOS.mm
>+++ b/Source/WebCore/editing/ios/EditorIOS.mm
>@@ -295,13 +295,13 @@ void Editor::setDictationPhrasesAsChildOfElement(const Vector<Vector<String>>& d
>         int dictationPhraseEnd = previousDictationPhraseStart + dictationPhraseLength;
>         if (interpretations.size() > 1) {
>             auto dictationPhraseRange = Range::create(document(), &textNode, previousDictationPhraseStart, &textNode, dictationPhraseEnd);
>-            document().markers().addDictationPhraseWithAlternativesMarker(dictationPhraseRange.ptr(), interpretations);
>+            document().markers().addDictationPhraseWithAlternativesMarker(dictationPhraseRange, interpretations);
>         }
>         previousDictationPhraseStart = dictationPhraseEnd;
>     }
> 
>     auto resultRange = Range::create(document(), &textNode, 0, &textNode, textNode.length());
>-    document().markers().addDictationResultMarker(resultRange.ptr(), metadata);
>+    document().markers().addDictationResultMarker(resultRange, metadata);
> 
>     client()->respondToChangedContents();
> }
>diff --git a/Source/WebCore/fileapi/FileReader.cpp b/Source/WebCore/fileapi/FileReader.cpp
>index ebf6b5c37da3eac82da9560b3de363b26866de3f..79a1de32fecac6e747127cd8c8652087bcc05ab8 100644
>--- a/Source/WebCore/fileapi/FileReader.cpp
>+++ b/Source/WebCore/fileapi/FileReader.cpp
>@@ -129,7 +129,7 @@ ExceptionOr<void> FileReader::readInternal(Blob& blob, FileReaderLoader::ReadTyp
>     if (m_state == LOADING)
>         return Exception { InvalidStateError };
> 
>-    setPendingActivity(this);
>+    setPendingActivity(*this);
> 
>     m_blob = &blob;
>     m_readType = type;
>@@ -166,7 +166,7 @@ void FileReader::abort()
>         fireEvent(eventNames().loadendEvent);
> 
>         // All possible events have fired and we're done, no more pending activity.
>-        unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
>     });
> }
> 
>@@ -201,7 +201,7 @@ void FileReader::didFinishLoading()
>     fireEvent(eventNames().loadendEvent);
>     
>     // All possible events have fired and we're done, no more pending activity.
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> void FileReader::didFail(int errorCode)
>@@ -218,7 +218,7 @@ void FileReader::didFail(int errorCode)
>     fireEvent(eventNames().loadendEvent);
>     
>     // All possible events have fired and we're done, no more pending activity.
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> void FileReader::fireEvent(const AtomicString& type)
>diff --git a/Source/WebCore/html/HTMLAppletElement.cpp b/Source/WebCore/html/HTMLAppletElement.cpp
>index 901c639ce360b5246ffcc3e90df9ec4a7580c95a..9140cb391a04488dafa0c80a5273bba22261f214 100644
>--- a/Source/WebCore/html/HTMLAppletElement.cpp
>+++ b/Source/WebCore/html/HTMLAppletElement.cpp
>@@ -27,7 +27,6 @@
> #include "ElementIterator.h"
> #include "Frame.h"
> #include "FrameLoader.h"
>-#include "HTMLDocument.h"
> #include "HTMLNames.h"
> #include "HTMLParamElement.h"
> #include "RenderEmbeddedObject.h"
>diff --git a/Source/WebCore/html/HTMLDocument.h b/Source/WebCore/html/HTMLDocument.h
>index 3060eb74c4a29a3beede80950b2c5a3b7b2e5b97..502b2233616cb3cb750777b3c95348fef69c3b1e 100644
>--- a/Source/WebCore/html/HTMLDocument.h
>+++ b/Source/WebCore/html/HTMLDocument.h
>@@ -29,16 +29,8 @@ namespace WebCore {
> class HTMLDocument : public Document {
>     WTF_MAKE_ISO_ALLOCATED(HTMLDocument);
> public:
>-    static Ref<HTMLDocument> create(Frame* frame, const URL& url)
>-    {
>-        return adoptRef(*new HTMLDocument(frame, url, HTMLDocumentClass));
>-    }
>-
>-    static Ref<HTMLDocument> createSynthesizedDocument(Frame* frame, const URL& url)
>-    {
>-        return adoptRef(*new HTMLDocument(frame, url, HTMLDocumentClass, Synthesized));
>-    }
>-
>+    static Ref<HTMLDocument> create(Frame*, const URL&);
>+    static Ref<HTMLDocument> createSynthesizedDocument(Frame&, const URL&);
>     virtual ~HTMLDocument();
> 
>     WEBCORE_EXPORT int width();
>@@ -65,7 +57,7 @@ protected:
>     HTMLDocument(Frame*, const URL&, DocumentClassFlags = 0, unsigned constructionFlags = 0);
> 
> private:
>-    bool isFrameSet() const override;
>+    bool isFrameSet() const final;
>     Ref<DocumentParser> createParser() override;
>     Ref<Document> cloneDocumentWithoutChildren() const final;
> 
>@@ -73,6 +65,16 @@ private:
>     TreeScopeOrderedMap m_windowNamedItem;
> };
> 
>+inline Ref<HTMLDocument> HTMLDocument::create(Frame* frame, const URL& url)
>+{
>+    return adoptRef(*new HTMLDocument(frame, url, HTMLDocumentClass));
>+}
>+
>+inline Ref<HTMLDocument> HTMLDocument::createSynthesizedDocument(Frame& frame, const URL& url)
>+{
>+    return adoptRef(*new HTMLDocument(&frame, url, HTMLDocumentClass, Synthesized));
>+}
>+
> } // namespace WebCore
> 
> SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::HTMLDocument)
>diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
>index 6c6af7b27436d65f8a2d0c7a1a05b4d26e1669da..db996b98ada4752d46a9f6d4f3426bdae2a56cdc 100644
>--- a/Source/WebCore/html/HTMLFormElement.cpp
>+++ b/Source/WebCore/html/HTMLFormElement.cpp
>@@ -81,7 +81,7 @@ HTMLFormElement::~HTMLFormElement()
> {
>     document().formController().willDeleteForm(*this);
>     if (!shouldAutocomplete())
>-        document().unregisterForDocumentSuspensionCallbacks(this);
>+        document().unregisterForDocumentSuspensionCallbacks(*this);
> 
>     m_defaultButton = nullptr;
>     for (auto& associatedElement : m_associatedElements)
>@@ -439,9 +439,9 @@ void HTMLFormElement::parseAttribute(const QualifiedName& name, const AtomicStri
>         m_attributes.setAcceptCharset(value);
>     else if (name == autocompleteAttr) {
>         if (!shouldAutocomplete())
>-            document().registerForDocumentSuspensionCallbacks(this);
>+            document().registerForDocumentSuspensionCallbacks(*this);
>         else
>-            document().unregisterForDocumentSuspensionCallbacks(this);
>+            document().unregisterForDocumentSuspensionCallbacks(*this);
>     } else
>         HTMLElement::parseAttribute(name, value);
> }
>@@ -843,8 +843,8 @@ void HTMLFormElement::resumeFromDocumentSuspension()
> void HTMLFormElement::didMoveToNewDocument(Document& oldDocument, Document& newDocument)
> {
>     if (!shouldAutocomplete()) {
>-        oldDocument.unregisterForDocumentSuspensionCallbacks(this);
>-        document().registerForDocumentSuspensionCallbacks(this);
>+        oldDocument.unregisterForDocumentSuspensionCallbacks(*this);
>+        newDocument.registerForDocumentSuspensionCallbacks(*this);
>     }
> 
>     HTMLElement::didMoveToNewDocument(oldDocument, newDocument);
>diff --git a/Source/WebCore/html/HTMLIFrameElement.cpp b/Source/WebCore/html/HTMLIFrameElement.cpp
>index 041710f60ca00035d02ab4754d360b5779798cd8..4e7319b80da63babced98774b9ab5c13d9d319a3 100644
>--- a/Source/WebCore/html/HTMLIFrameElement.cpp
>+++ b/Source/WebCore/html/HTMLIFrameElement.cpp
>@@ -28,7 +28,6 @@
> #include "CSSPropertyNames.h"
> #include "DOMTokenList.h"
> #include "Frame.h"
>-#include "HTMLDocument.h"
> #include "HTMLNames.h"
> #include "RenderIFrame.h"
> #include "ScriptableDocumentParser.h"
>diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
>index 1dcd7e1dd1445da97e21f0e4e0beb6838d4dff6b..bcf89c7755be4bdf0b5978269f0f1ae7de990c73 100644
>--- a/Source/WebCore/html/HTMLInputElement.cpp
>+++ b/Source/WebCore/html/HTMLInputElement.cpp
>@@ -161,7 +161,7 @@ void HTMLInputElement::didAddUserAgentShadowRoot(ShadowRoot&)
> HTMLInputElement::~HTMLInputElement()
> {
>     if (needsSuspensionCallback())
>-        document().unregisterForDocumentSuspensionCallbacks(this);
>+        document().unregisterForDocumentSuspensionCallbacks(*this);
> 
>     // Need to remove form association while this is still an HTMLInputElement
>     // so that virtual functions are called correctly.
>@@ -169,7 +169,7 @@ HTMLInputElement::~HTMLInputElement()
>     // setForm(0) may register this to a document-level radio button group.
>     // We should unregister it to avoid accessing a deleted object.
>     if (isRadioButton())
>-        document().formController().radioButtonGroups().removeButton(this);
>+        document().formController().radioButtonGroups().removeButton(*this);
> #if ENABLE(TOUCH_EVENTS)
>     if (m_hasTouchEventHandler)
>         document().didRemoveEventTargetNode(*this);
>@@ -923,7 +923,7 @@ void HTMLInputElement::setChecked(bool nowChecked)
>     invalidateStyleForSubtree();
> 
>     if (RadioButtonGroups* buttons = radioButtonGroups())
>-        buttons->updateCheckedState(this);
>+        buttons->updateCheckedState(*this);
>     if (renderer() && renderer()->style().hasAppearance())
>         renderer()->theme().stateChanged(*renderer(), ControlStates::CheckedState);
>     updateValidity();
>@@ -1442,13 +1442,13 @@ bool HTMLInputElement::needsSuspensionCallback()
> void HTMLInputElement::registerForSuspensionCallbackIfNeeded()
> {
>     if (needsSuspensionCallback())
>-        document().registerForDocumentSuspensionCallbacks(this);
>+        document().registerForDocumentSuspensionCallbacks(*this);
> }
> 
> void HTMLInputElement::unregisterForSuspensionCallbackIfNeeded()
> {
>     if (!needsSuspensionCallback())
>-        document().unregisterForDocumentSuspensionCallbacks(this);
>+        document().unregisterForDocumentSuspensionCallbacks(*this);
> }
> 
> bool HTMLInputElement::isRequiredFormControl() const
>@@ -1547,11 +1547,11 @@ void HTMLInputElement::didMoveToNewDocument(Document& oldDocument, Document& new
> 
>     // Always unregister for cache callbacks when leaving a document, even if we would otherwise like to be registered
>     if (needsSuspensionCallback()) {
>-        oldDocument.unregisterForDocumentSuspensionCallbacks(this);
>-        newDocument.registerForDocumentSuspensionCallbacks(this);
>+        oldDocument.unregisterForDocumentSuspensionCallbacks(*this);
>+        newDocument.registerForDocumentSuspensionCallbacks(*this);
>     }
>     if (isRadioButton())
>-        oldDocument.formController().radioButtonGroups().removeButton(this);
>+        oldDocument.formController().radioButtonGroups().removeButton(*this);
> #if ENABLE(TOUCH_EVENTS)
>     if (m_hasTouchEventHandler) {
>         oldDocument.didRemoveEventTargetNode(*this);
>@@ -1868,7 +1868,7 @@ bool HTMLInputElement::isInRequiredRadioButtonGroup()
> {
>     ASSERT(isRadioButton());
>     if (RadioButtonGroups* buttons = radioButtonGroups())
>-        return buttons->isInRequiredGroup(this);
>+        return buttons->isInRequiredGroup(*this);
>     return false;
> }
> 
>@@ -1900,14 +1900,14 @@ RadioButtonGroups* HTMLInputElement::radioButtonGroups() const
> 
> inline void HTMLInputElement::addToRadioButtonGroup()
> {
>-    if (RadioButtonGroups* buttons = radioButtonGroups())
>-        buttons->addButton(this);
>+    if (auto* buttons = radioButtonGroups())
>+        buttons->addButton(*this);
> }
> 
> inline void HTMLInputElement::removeFromRadioButtonGroup()
> {
>-    if (RadioButtonGroups* buttons = radioButtonGroups())
>-        buttons->removeButton(this);
>+    if (auto* buttons = radioButtonGroups())
>+        buttons->removeButton(*this);
> }
> 
> unsigned HTMLInputElement::height() const
>diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
>index 180c43d1589695d966de0903e9de2b2c4518c30f..5e09f09b282cb782f87225c56db7565212e36162 100644
>--- a/Source/WebCore/html/HTMLMediaElement.cpp
>+++ b/Source/WebCore/html/HTMLMediaElement.cpp
>@@ -704,33 +704,33 @@ void HTMLMediaElement::registerWithDocument(Document& document)
>     m_mediaSession->registerWithDocument(document);
> 
>     if (m_isWaitingUntilMediaCanStart)
>-        document.addMediaCanStartListener(this);
>+        document.addMediaCanStartListener(*this);
> 
> #if !PLATFORM(IOS_FAMILY)
>-    document.registerForMediaVolumeCallbacks(this);
>-    document.registerForPrivateBrowsingStateChangedCallbacks(this);
>+    document.registerForMediaVolumeCallbacks(*this);
>+    document.registerForPrivateBrowsingStateChangedCallbacks(*this);
> #endif
> 
>-    document.registerForVisibilityStateChangedCallbacks(this);
>+    document.registerForVisibilityStateChangedCallbacks(*this);
> 
> #if ENABLE(VIDEO_TRACK)
>     if (m_requireCaptionPreferencesChangedCallbacks)
>-        document.registerForCaptionPreferencesChangedCallbacks(this);
>+        document.registerForCaptionPreferencesChangedCallbacks(*this);
> #endif
> 
> #if ENABLE(MEDIA_CONTROLS_SCRIPT)
>     if (m_mediaControlsDependOnPageScaleFactor)
>-        document.registerForPageScaleFactorChangedCallbacks(this);
>+        document.registerForPageScaleFactorChangedCallbacks(*this);
>     document.registerForUserInterfaceLayoutDirectionChangedCallbacks(*this);
> #endif
> 
> #if ENABLE(WIRELESS_PLAYBACK_TARGET)
>-    document.registerForDocumentSuspensionCallbacks(this);
>+    document.registerForDocumentSuspensionCallbacks(*this);
> #endif
> 
>     document.registerForAllowsMediaDocumentInlinePlaybackChangedCallbacks(*this);
> 
>-    document.addAudioProducer(this);
>+    document.addAudioProducer(*this);
>     addElementToDocumentMap(*this, document);
> 
> #if ENABLE(MEDIA_STREAM)
>@@ -745,33 +745,33 @@ void HTMLMediaElement::unregisterWithDocument(Document& document)
>     m_mediaSession->unregisterWithDocument(document);
> 
>     if (m_isWaitingUntilMediaCanStart)
>-        document.removeMediaCanStartListener(this);
>+        document.removeMediaCanStartListener(*this);
> 
> #if !PLATFORM(IOS_FAMILY)
>-    document.unregisterForMediaVolumeCallbacks(this);
>-    document.unregisterForPrivateBrowsingStateChangedCallbacks(this);
>+    document.unregisterForMediaVolumeCallbacks(*this);
>+    document.unregisterForPrivateBrowsingStateChangedCallbacks(*this);
> #endif
> 
>-    document.unregisterForVisibilityStateChangedCallbacks(this);
>+    document.unregisterForVisibilityStateChangedCallbacks(*this);
> 
> #if ENABLE(VIDEO_TRACK)
>     if (m_requireCaptionPreferencesChangedCallbacks)
>-        document.unregisterForCaptionPreferencesChangedCallbacks(this);
>+        document.unregisterForCaptionPreferencesChangedCallbacks(*this);
> #endif
> 
> #if ENABLE(MEDIA_CONTROLS_SCRIPT)
>     if (m_mediaControlsDependOnPageScaleFactor)
>-        document.unregisterForPageScaleFactorChangedCallbacks(this);
>+        document.unregisterForPageScaleFactorChangedCallbacks(*this);
>     document.unregisterForUserInterfaceLayoutDirectionChangedCallbacks(*this);
> #endif
> 
> #if ENABLE(WIRELESS_PLAYBACK_TARGET)
>-    document.unregisterForDocumentSuspensionCallbacks(this);
>+    document.unregisterForDocumentSuspensionCallbacks(*this);
> #endif
> 
>     document.unregisterForAllowsMediaDocumentInlinePlaybackChangedCallbacks(*this);
> 
>-    document.removeAudioProducer(this);
>+    document.removeAudioProducer(*this);
>     removeElementFromDocumentMap(*this, document);
> 
> #if ENABLE(MEDIA_STREAM)
>@@ -1341,7 +1341,7 @@ void HTMLMediaElement::selectMediaResource()
>         if (m_isWaitingUntilMediaCanStart)
>             return;
>         m_isWaitingUntilMediaCanStart = true;
>-        document().addMediaCanStartListener(this);
>+        document().addMediaCanStartListener(*this);
>         return;
>     }
> 
>@@ -4068,7 +4068,7 @@ void HTMLMediaElement::addTextTrack(Ref<TextTrack>&& track)
>     if (!m_requireCaptionPreferencesChangedCallbacks) {
>         m_requireCaptionPreferencesChangedCallbacks = true;
>         Document& document = this->document();
>-        document.registerForCaptionPreferencesChangedCallbacks(this);
>+        document.registerForCaptionPreferencesChangedCallbacks(*this);
>         if (Page* page = document.page())
>             m_captionDisplayMode = page->group().captionPreferences().captionDisplayMode();
>     }
>@@ -5612,7 +5612,7 @@ void HTMLMediaElement::clearMediaPlayer()
> 
>     if (m_isWaitingUntilMediaCanStart) {
>         m_isWaitingUntilMediaCanStart = false;
>-        document().removeMediaCanStartListener(this);
>+        document().removeMediaCanStartListener(*this);
>     }
> 
>     if (m_player) {
>@@ -5757,7 +5757,7 @@ void HTMLMediaElement::resume()
>     setShouldBufferData(true);
> 
>     if (!m_mediaSession->pageAllowsPlaybackAfterResuming())
>-        document().addMediaCanStartListener(this);
>+        document().addMediaCanStartListener(*this);
>     else
>         setPausedInternal(false);
> 
>@@ -7382,9 +7382,9 @@ void HTMLMediaElement::setMediaControlsDependOnPageScaleFactor(bool dependsOnPag
>     m_mediaControlsDependOnPageScaleFactor = dependsOnPageScale;
> 
>     if (m_mediaControlsDependOnPageScaleFactor)
>-        document().registerForPageScaleFactorChangedCallbacks(this);
>+        document().registerForPageScaleFactorChangedCallbacks(*this);
>     else
>-        document().unregisterForPageScaleFactorChangedCallbacks(this);
>+        document().unregisterForPageScaleFactorChangedCallbacks(*this);
> }
> 
> void HTMLMediaElement::updateMediaControlsAfterPresentationModeChange()
>diff --git a/Source/WebCore/html/HTMLNameCollection.cpp b/Source/WebCore/html/HTMLNameCollection.cpp
>index d10c37fb22881c13c30f07c7b934f9327546f1ea..e118bde1ddc223a93b7184ba6077891ccaa2b760 100644
>--- a/Source/WebCore/html/HTMLNameCollection.cpp
>+++ b/Source/WebCore/html/HTMLNameCollection.cpp
>@@ -25,7 +25,6 @@
> 
> #include "Element.h"
> #include "HTMLAppletElement.h"
>-#include "HTMLDocument.h"
> #include "HTMLEmbedElement.h"
> #include "HTMLFormElement.h"
> #include "HTMLIFrameElement.h"
>diff --git a/Source/WebCore/html/HTMLPlugInImageElement.cpp b/Source/WebCore/html/HTMLPlugInImageElement.cpp
>index 9e5c27777d693e4f64bef1b731258395c4ad2304..95dac135b7562b6a21092342fbad0fa4e0ad886a 100644
>--- a/Source/WebCore/html/HTMLPlugInImageElement.cpp
>+++ b/Source/WebCore/html/HTMLPlugInImageElement.cpp
>@@ -119,7 +119,7 @@ void HTMLPlugInImageElement::finishCreating()
> HTMLPlugInImageElement::~HTMLPlugInImageElement()
> {
>     if (m_needsDocumentActivationCallbacks)
>-        document().unregisterForDocumentSuspensionCallbacks(this);
>+        document().unregisterForDocumentSuspensionCallbacks(*this);
> }
> 
> void HTMLPlugInImageElement::setDisplayState(DisplayState state)
>@@ -185,7 +185,7 @@ RenderPtr<RenderElement> HTMLPlugInImageElement::createElementRenderer(RenderSty
>     // inactive or reactivates so it can clear the renderer before going into the page cache.
>     if (!m_needsDocumentActivationCallbacks) {
>         m_needsDocumentActivationCallbacks = true;
>-        document().registerForDocumentSuspensionCallbacks(this);
>+        document().registerForDocumentSuspensionCallbacks(*this);
>     }
> 
>     if (displayState() == DisplayingSnapshot) {
>@@ -301,8 +301,8 @@ void HTMLPlugInImageElement::didMoveToNewDocument(Document& oldDocument, Documen
> {
>     ASSERT_WITH_SECURITY_IMPLICATION(&document() == &newDocument);
>     if (m_needsDocumentActivationCallbacks) {
>-        oldDocument.unregisterForDocumentSuspensionCallbacks(this);
>-        newDocument.registerForDocumentSuspensionCallbacks(this);
>+        oldDocument.unregisterForDocumentSuspensionCallbacks(*this);
>+        newDocument.registerForDocumentSuspensionCallbacks(*this);
>     }
> 
>     if (m_imageLoader)
>diff --git a/Source/WebCore/html/HTMLSourceElement.cpp b/Source/WebCore/html/HTMLSourceElement.cpp
>index cfdeb535229e94dcfe3aeb8cd4bc96b2885c959a..2361422992466f5c4625de94c4f064a63e5fbd70 100644
>--- a/Source/WebCore/html/HTMLSourceElement.cpp
>+++ b/Source/WebCore/html/HTMLSourceElement.cpp
>@@ -28,7 +28,6 @@
> 
> #include "Event.h"
> #include "EventNames.h"
>-#include "HTMLDocument.h"
> #include "HTMLNames.h"
> #include "HTMLPictureElement.h"
> #include "Logging.h"
>diff --git a/Source/WebCore/html/HTMLTemplateElement.cpp b/Source/WebCore/html/HTMLTemplateElement.cpp
>index 818eff6e75961bba0b5bac656819951be206bb38..80f722a605ae92b91ed789f177eb78aff1e2709e 100644
>--- a/Source/WebCore/html/HTMLTemplateElement.cpp
>+++ b/Source/WebCore/html/HTMLTemplateElement.cpp
>@@ -32,7 +32,6 @@
> #include "HTMLTemplateElement.h"
> 
> #include "DocumentFragment.h"
>-#include "HTMLDocument.h"
> #include "TemplateContentDocumentFragment.h"
> #include "markup.h"
> #include <wtf/IsoMallocInlines.h>
>diff --git a/Source/WebCore/html/RadioInputType.cpp b/Source/WebCore/html/RadioInputType.cpp
>index 7fcfc750fdeae122bfd1ad284ef3c5507b26ae61..613d5450ddcfd44ddcdb7ba6ef402d981fb21f1b 100644
>--- a/Source/WebCore/html/RadioInputType.cpp
>+++ b/Source/WebCore/html/RadioInputType.cpp
>@@ -184,9 +184,9 @@ bool RadioInputType::isRadioButton() const
> bool RadioInputType::matchesIndeterminatePseudoClass() const
> {
>     ASSERT(element());
>-    const HTMLInputElement& element = *this->element();
>-    if (const RadioButtonGroups* radioButtonGroups = element.radioButtonGroups())
>-        return !radioButtonGroups->hasCheckedButton(&element);
>+    auto& element = *this->element();
>+    if (auto* radioButtonGroups = element.radioButtonGroups())
>+        return !radioButtonGroups->hasCheckedButton(element);
>     return !element.checked();
> }
> 
>diff --git a/Source/WebCore/loader/DocumentWriter.cpp b/Source/WebCore/loader/DocumentWriter.cpp
>index 093a0fe788ca46e1c5b92b6d651313bc077ab125..86593c30aad576319c27dedf17d2152d2e89f921 100644
>--- a/Source/WebCore/loader/DocumentWriter.cpp
>+++ b/Source/WebCore/loader/DocumentWriter.cpp
>@@ -146,7 +146,7 @@ bool DocumentWriter::begin(const URL& urlReference, bool dispatch, Document* own
> 
>     bool shouldReuseDefaultView = m_frame->loader().stateMachine().isDisplayingInitialEmptyDocument() && m_frame->document()->isSecureTransitionTo(url);
>     if (shouldReuseDefaultView)
>-        document->takeDOMWindowFrom(m_frame->document());
>+        document->takeDOMWindowFrom(*m_frame->document());
>     else
>         document->createDOMWindow();
> 
>diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
>index 2c766f9585487577fb5d6a9d3cb7872ddfee2901..58e0b0851a3b39900a3727d3a6c564918988df20 100644
>--- a/Source/WebCore/page/DOMWindow.cpp
>+++ b/Source/WebCore/page/DOMWindow.cpp
>@@ -1844,9 +1844,9 @@ bool DOMWindow::addEventListener(const AtomicString& eventType, Ref<EventListene
>         if ((eventType == eventNames().devicemotionEvent || eventType == eventNames().deviceorientationEvent)) {
>             if (isSameSecurityOriginAsMainFrame() && isSecureContext()) {
>                 if (eventType == eventNames().deviceorientationEvent)
>-                    document()->deviceOrientationController()->addDeviceEventListener(this);
>+                    document()->deviceOrientationController().addDeviceEventListener(*this);
>                 else
>-                    document()->deviceMotionController()->addDeviceEventListener(this);
>+                    document()->deviceMotionController().addDeviceEventListener(*this);
>             } else if (document()) {
>                 if (isSecureContext())
>                     document()->addConsoleMessage(MessageSource::JS, MessageLevel::Warning, "Blocked attempt to add a device motion or orientation listener from child frame that wasn't the same security origin as the main page."_s);
>@@ -1858,13 +1858,13 @@ bool DOMWindow::addEventListener(const AtomicString& eventType, Ref<EventListene
>         if (eventType == eventNames().devicemotionEvent) {
>             if (isSameSecurityOriginAsMainFrame() && isSecureContext()) {
>                 if (DeviceMotionController* controller = DeviceMotionController::from(page()))
>-                    controller->addDeviceEventListener(this);
>+                    controller->addDeviceEventListener(*this);
>             } else
>                 document()->addConsoleMessage(MessageSource::JS, MessageLevel::Warning, "Blocked attempt to add a device motion listener from child frame that wasn't the same security origin as the main page."_s);
>         } else if (eventType == eventNames().deviceorientationEvent) {
>             if (isSameSecurityOriginAsMainFrame() && isSecureContext()) {
>                 if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
>-                    controller->addDeviceEventListener(this);
>+                    controller->addDeviceEventListener(*this);
>             } else {
>                 if (isSecureContext())
>                     document()->addConsoleMessage(MessageSource::JS, MessageLevel::Warning, "Blocked attempt to add a device orientation listener from child frame that wasn't the same security origin as the main page."_s);
>@@ -1931,16 +1931,16 @@ bool DOMWindow::removeEventListener(const AtomicString& eventType, EventListener
> #if ENABLE(DEVICE_ORIENTATION)
> #if PLATFORM(IOS_FAMILY)
>     else if (eventType == eventNames().devicemotionEvent && document())
>-        document()->deviceMotionController()->removeDeviceEventListener(this);
>+        document()->deviceMotionController().removeDeviceEventListener(*this);
>     else if (eventType == eventNames().deviceorientationEvent && document())
>-        document()->deviceOrientationController()->removeDeviceEventListener(this);
>+        document()->deviceOrientationController().removeDeviceEventListener(*this);
> #else
>     else if (eventType == eventNames().devicemotionEvent) {
>         if (DeviceMotionController* controller = DeviceMotionController::from(page()))
>-            controller->removeDeviceEventListener(this);
>+            controller->removeDeviceEventListener(*this);
>     } else if (eventType == eventNames().deviceorientationEvent) {
>         if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
>-            controller->removeDeviceEventListener(this);
>+            controller->removeDeviceEventListener(*this);
>     }
> #endif // PLATFORM(IOS_FAMILY)
> #endif // ENABLE(DEVICE_ORIENTATION)
>@@ -2048,14 +2048,14 @@ void DOMWindow::removeAllEventListeners()
> #if ENABLE(DEVICE_ORIENTATION)
> #if PLATFORM(IOS_FAMILY)
>     if (Document* document = this->document()) {
>-        document->deviceMotionController()->removeAllDeviceEventListeners(this);
>-        document->deviceOrientationController()->removeAllDeviceEventListeners(this);
>+        document->deviceMotionController().removeAllDeviceEventListeners(*this);
>+        document->deviceOrientationController().removeAllDeviceEventListeners(*this);
>     }
> #else
>     if (DeviceMotionController* controller = DeviceMotionController::from(page()))
>-        controller->removeAllDeviceEventListeners(this);
>+        controller->removeAllDeviceEventListeners(*this);
>     if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
>-        controller->removeAllDeviceEventListeners(this);
>+        controller->removeAllDeviceEventListeners(*this);
> #endif // PLATFORM(IOS_FAMILY)
> #endif // ENABLE(DEVICE_ORIENTATION)
> 
>diff --git a/Source/WebCore/page/DeviceController.cpp b/Source/WebCore/page/DeviceController.cpp
>index 41a027b1355152c48633de4d01cf6c202d3d67ba..3367d3dbf59fc3357249758ac63dd1725e076366 100644
>--- a/Source/WebCore/page/DeviceController.cpp
>+++ b/Source/WebCore/page/DeviceController.cpp
>@@ -32,42 +32,41 @@
> 
> namespace WebCore {
> 
>-DeviceController::DeviceController(DeviceClient* client)
>+DeviceController::DeviceController(DeviceClient& client)
>     : m_client(client)
>     , m_timer(*this, &DeviceController::fireDeviceEvent)
> {
>-    ASSERT(m_client);
> }
> 
>-void DeviceController::addDeviceEventListener(DOMWindow* window)
>+void DeviceController::addDeviceEventListener(DOMWindow& window)
> {
>     bool wasEmpty = m_listeners.isEmpty();
>-    m_listeners.add(window);
>+    m_listeners.add(&window);
> 
>     if (hasLastData()) {
>-        m_lastEventListeners.add(window);
>+        m_lastEventListeners.add(&window);
>         if (!m_timer.isActive())
>             m_timer.startOneShot(0_s);
>     }
> 
>     if (wasEmpty)
>-        m_client->startUpdating();
>+        m_client.startUpdating();
> }
> 
>-void DeviceController::removeDeviceEventListener(DOMWindow* window)
>+void DeviceController::removeDeviceEventListener(DOMWindow& window)
> {
>-    m_listeners.remove(window);
>-    m_lastEventListeners.remove(window);
>+    m_listeners.remove(&window);
>+    m_lastEventListeners.remove(&window);
>     if (m_listeners.isEmpty())
>-        m_client->stopUpdating();
>+        m_client.stopUpdating();
> }
> 
>-void DeviceController::removeAllDeviceEventListeners(DOMWindow* window)
>+void DeviceController::removeAllDeviceEventListeners(DOMWindow& window)
> {
>-    m_listeners.removeAll(window);
>-    m_lastEventListeners.removeAll(window);
>+    m_listeners.removeAll(&window);
>+    m_lastEventListeners.removeAll(&window);
>     if (m_listeners.isEmpty())
>-        m_client->stopUpdating();
>+        m_client.stopUpdating();
> }
> 
> void DeviceController::dispatchDeviceEvent(Event& event)
>diff --git a/Source/WebCore/page/DeviceController.h b/Source/WebCore/page/DeviceController.h
>index 200f3189c775f58c69aeda9ce2e2b6f7f151314b..e160385afe2f97353c0ea22f29e856f18e20b1a8 100644
>--- a/Source/WebCore/page/DeviceController.h
>+++ b/Source/WebCore/page/DeviceController.h
>@@ -40,16 +40,16 @@ class Page;
> class DeviceController : public Supplement<Page> {
>     WTF_MAKE_FAST_ALLOCATED;
> public:
>-    explicit DeviceController(DeviceClient*);
>+    explicit DeviceController(DeviceClient&);
>     virtual ~DeviceController() = default;
> 
>-    void addDeviceEventListener(DOMWindow*);
>-    void removeDeviceEventListener(DOMWindow*);
>-    void removeAllDeviceEventListeners(DOMWindow*);
>+    void addDeviceEventListener(DOMWindow&);
>+    void removeDeviceEventListener(DOMWindow&);
>+    void removeAllDeviceEventListeners(DOMWindow&);
> 
>     void dispatchDeviceEvent(Event&);
>     bool isActive() { return !m_listeners.isEmpty(); }
>-    DeviceClient* client() { return m_client; }
>+    DeviceClient& client() { return m_client; }
> 
>     virtual bool hasLastData() { return false; }
>     virtual RefPtr<Event> getLastEvent() { return nullptr; }
>@@ -59,7 +59,7 @@ protected:
> 
>     HashCountedSet<RefPtr<DOMWindow>> m_listeners;
>     HashCountedSet<RefPtr<DOMWindow>> m_lastEventListeners;
>-    DeviceClient* m_client;
>+    DeviceClient& m_client;
>     Timer m_timer;
> };
> 
>diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
>index 8946e950a15616d15c3a91f4abbd3265f43584b1..59fd3e01af9dd757dd031321852c6197c296c2a3 100644
>--- a/Source/WebCore/page/EventHandler.cpp
>+++ b/Source/WebCore/page/EventHandler.cpp
>@@ -51,6 +51,7 @@
> #include "FrameSelection.h"
> #include "FrameTree.h"
> #include "FrameView.h"
>+#include "HTMLDocument.h"
> #include "HTMLFrameElement.h"
> #include "HTMLFrameSetElement.h"
> #include "HTMLHtmlElement.h"
>@@ -3577,7 +3578,7 @@ void EventHandler::didStartDrag()
>     }
> 
>     if (draggedContentRange) {
>-        draggedContentRange->ownerDocument().markers().addDraggedContentMarker(draggedContentRange.get());
>+        draggedContentRange->ownerDocument().markers().addDraggedContentMarker(*draggedContentRange);
>         if (auto* renderer = m_frame.contentRenderer())
>             renderer->repaintRootContents();
>     }
>diff --git a/Source/WebCore/page/EventSource.cpp b/Source/WebCore/page/EventSource.cpp
>index d1325135322eaab3ada81e7b7b6e772257c4cfc1..930f30b5c9a9533d8927068dd7991f85b2b44907 100644
>--- a/Source/WebCore/page/EventSource.cpp
>+++ b/Source/WebCore/page/EventSource.cpp
>@@ -74,7 +74,7 @@ ExceptionOr<Ref<EventSource>> EventSource::create(ScriptExecutionContext& contex
>     }
> 
>     auto source = adoptRef(*new EventSource(context, fullURL, eventSourceInit));
>-    source->setPendingActivity(source.ptr());
>+    source->setPendingActivity(source.get());
>     source->scheduleInitialConnect();
>     source->suspendIfNeeded();
>     return WTFMove(source);
>@@ -125,7 +125,7 @@ void EventSource::networkRequestEnded()
>     if (m_state != CLOSED)
>         scheduleReconnect();
>     else
>-        unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
> }
> 
> void EventSource::scheduleInitialConnect()
>@@ -158,7 +158,7 @@ void EventSource::close()
>         m_loader->cancel();
>     else {
>         m_state = CLOSED;
>-        unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
>     }
> }
> 
>@@ -260,7 +260,7 @@ void EventSource::abortConnectionAttempt()
>         m_loader->cancel();
>     else {
>         m_state = CLOSED;
>-        unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
>     }
> 
>     ASSERT(m_state == CLOSED);
>diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
>index 73bafdb46602785ff41415fe2699a0ab710a19ca..a4f83b27f0b6ecaf653321d6a554457ece669daa 100644
>--- a/Source/WebCore/page/Frame.cpp
>+++ b/Source/WebCore/page/Frame.cpp
>@@ -57,7 +57,6 @@
> #include "FrameView.h"
> #include "GraphicsContext.h"
> #include "GraphicsLayer.h"
>-#include "HTMLDocument.h"
> #include "HTMLFormControlElement.h"
> #include "HTMLFormElement.h"
> #include "HTMLFrameElementBase.h"
>diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
>index e4714aadf6c0d52a887e62e1e46926316b69cd9b..f96481f28e753fe417b1e552dd3d8e7b7d7cf341 100644
>--- a/Source/WebCore/page/FrameView.cpp
>+++ b/Source/WebCore/page/FrameView.cpp
>@@ -50,7 +50,6 @@
> #include "FrameTree.h"
> #include "GraphicsContext.h"
> #include "HTMLBodyElement.h"
>-#include "HTMLDocument.h"
> #include "HTMLEmbedElement.h"
> #include "HTMLFrameElement.h"
> #include "HTMLFrameSetElement.h"
>@@ -4464,7 +4463,7 @@ bool FrameView::qualifiesAsVisuallyNonEmpty() const
> 
>     auto isMoreContentExpected = [&]() {
>         // Pending css/javascript/font loading/processing means we should wait a little longer.
>-        auto hasPendingScriptExecution = frame().document()->scriptRunner() && frame().document()->scriptRunner()->hasPendingScripts();
>+        auto hasPendingScriptExecution = frame().document()->scriptRunner().hasPendingScripts();
>         if (hasPendingScriptExecution)
>             return true;
> 
>diff --git a/Source/WebCore/page/animation/AnimationBase.cpp b/Source/WebCore/page/animation/AnimationBase.cpp
>index ad5f154d8ec979083bd1455a351db2ee014a23f2..8a3b3b965ab687382bcef0f7c2ec136813dea3dc 100644
>--- a/Source/WebCore/page/animation/AnimationBase.cpp
>+++ b/Source/WebCore/page/animation/AnimationBase.cpp
>@@ -158,7 +158,7 @@ void AnimationBase::updateStateMachine(AnimationStateInput input, double param)
>     // If we get AnimationStateInput::RestartAnimation then we force a new animation, regardless of state.
>     if (input == AnimationStateInput::MakeNew) {
>         if (m_animationState == AnimationState::StartWaitStyleAvailable)
>-            m_compositeAnimation->animationController().removeFromAnimationsWaitingForStyle(this);
>+            m_compositeAnimation->animationController().removeFromAnimationsWaitingForStyle(*this);
>         LOG(Animations, "%p AnimationState %s -> New", this, nameForState(m_animationState));
>         m_animationState = AnimationState::New;
>         m_startTime = WTF::nullopt;
>@@ -171,7 +171,7 @@ void AnimationBase::updateStateMachine(AnimationStateInput input, double param)
> 
>     if (input == AnimationStateInput::RestartAnimation) {
>         if (m_animationState == AnimationState::StartWaitStyleAvailable)
>-            m_compositeAnimation->animationController().removeFromAnimationsWaitingForStyle(this);
>+            m_compositeAnimation->animationController().removeFromAnimationsWaitingForStyle(*this);
>         LOG(Animations, "%p AnimationState %s -> New", this, nameForState(m_animationState));
>         m_animationState = AnimationState::New;
>         m_startTime = WTF::nullopt;
>@@ -187,7 +187,7 @@ void AnimationBase::updateStateMachine(AnimationStateInput input, double param)
> 
>     if (input == AnimationStateInput::EndAnimation) {
>         if (m_animationState == AnimationState::StartWaitStyleAvailable)
>-            m_compositeAnimation->animationController().removeFromAnimationsWaitingForStyle(this);
>+            m_compositeAnimation->animationController().removeFromAnimationsWaitingForStyle(*this);
>         LOG(Animations, "%p AnimationState %s -> Done", this, nameForState(m_animationState));
>         m_animationState = AnimationState::Done;
>         endAnimation();
>@@ -237,7 +237,7 @@ void AnimationBase::updateStateMachine(AnimationStateInput input, double param)
>                 // Start timer has fired, tell the animation to start and wait for it to respond with start time
>                 LOG(Animations, "%p AnimationState %s -> StartWaitStyleAvailable (time is %f)", this, nameForState(m_animationState), param);
>                 m_animationState = AnimationState::StartWaitStyleAvailable;
>-                m_compositeAnimation->animationController().addToAnimationsWaitingForStyle(this);
>+                m_compositeAnimation->animationController().addToAnimationsWaitingForStyle(*this);
> 
>                 // Trigger a render so we can start the animation
>                 if (m_element)
>@@ -275,7 +275,7 @@ void AnimationBase::updateStateMachine(AnimationStateInput input, double param)
>                         timeOffset = -m_animation->delay();
>                     bool started = startAnimation(timeOffset);
> 
>-                    m_compositeAnimation->animationController().addToAnimationsWaitingForStartTimeResponse(this, started);
>+                    m_compositeAnimation->animationController().addToAnimationsWaitingForStartTimeResponse(*this, started);
>                     m_isAccelerated = started;
>                 }
>             } else {
>@@ -431,7 +431,7 @@ void AnimationBase::updateStateMachine(AnimationStateInput input, double param)
>                         m_isAccelerated = true;
>                     } else {
>                         bool started = startAnimation(beginAnimationUpdateTime() - m_startTime.valueOr(0));
>-                        m_compositeAnimation->animationController().addToAnimationsWaitingForStartTimeResponse(this, started);
>+                        m_compositeAnimation->animationController().addToAnimationsWaitingForStartTimeResponse(*this, started);
>                         m_isAccelerated = started;
>                     }
>                 }
>diff --git a/Source/WebCore/page/animation/CSSAnimationController.cpp b/Source/WebCore/page/animation/CSSAnimationController.cpp
>index 339913cd72c65c66d99a3bc3c6f816e291d4f7f0..8bb94e998abe5a65cdb2832d75dff1e6c5a597b0 100644
>--- a/Source/WebCore/page/animation/CSSAnimationController.cpp
>+++ b/Source/WebCore/page/animation/CSSAnimationController.cpp
>@@ -507,17 +507,15 @@ unsigned CSSAnimationControllerPrivate::numberOfActiveAnimations(Document* docum
>     return count;
> }
> 
>-void CSSAnimationControllerPrivate::addToAnimationsWaitingForStyle(AnimationBase* animation)
>+void CSSAnimationControllerPrivate::addToAnimationsWaitingForStyle(AnimationBase& animation)
> {
>-    // Make sure this animation is not in the start time waiters
>-    m_animationsWaitingForStartTimeResponse.remove(animation);
>-
>-    m_animationsWaitingForStyle.add(animation);
>+    m_animationsWaitingForStartTimeResponse.remove(&animation);
>+    m_animationsWaitingForStyle.add(&animation);
> }
> 
>-void CSSAnimationControllerPrivate::removeFromAnimationsWaitingForStyle(AnimationBase* animationToRemove)
>+void CSSAnimationControllerPrivate::removeFromAnimationsWaitingForStyle(AnimationBase& animationToRemove)
> {
>-    m_animationsWaitingForStyle.remove(animationToRemove);
>+    m_animationsWaitingForStyle.remove(&animationToRemove);
> }
> 
> void CSSAnimationControllerPrivate::styleAvailable()
>@@ -529,7 +527,7 @@ void CSSAnimationControllerPrivate::styleAvailable()
>     m_animationsWaitingForStyle.clear();
> }
> 
>-void CSSAnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse(AnimationBase* animation, bool willGetResponse)
>+void CSSAnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse(AnimationBase& animation, bool willGetResponse)
> {
>     // If willGetResponse is true, it means this animation is actually waiting for a response
>     // (which will come in as a call to notifyAnimationStarted()).
>@@ -548,17 +546,16 @@ void CSSAnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse(A
>     // This will synchronize all software and accelerated animations started in the same 
>     // updateStyleIfNeeded cycle.
>     //
>-    
>+
>     if (willGetResponse)
>         m_waitingForAsyncStartNotification = true;
> 
>-    m_animationsWaitingForStartTimeResponse.add(animation);
>+    m_animationsWaitingForStartTimeResponse.add(&animation);
> }
> 
>-void CSSAnimationControllerPrivate::removeFromAnimationsWaitingForStartTimeResponse(AnimationBase* animationToRemove)
>+void CSSAnimationControllerPrivate::removeFromAnimationsWaitingForStartTimeResponse(AnimationBase& animationToRemove)
> {
>-    m_animationsWaitingForStartTimeResponse.remove(animationToRemove);
>-    
>+    m_animationsWaitingForStartTimeResponse.remove(&animationToRemove);
>     if (m_animationsWaitingForStartTimeResponse.isEmpty())
>         m_waitingForAsyncStartNotification = false;
> }
>@@ -574,9 +571,9 @@ void CSSAnimationControllerPrivate::startTimeResponse(MonotonicTime time)
>     m_waitingForAsyncStartNotification = false;
> }
> 
>-void CSSAnimationControllerPrivate::animationWillBeRemoved(AnimationBase* animation)
>+void CSSAnimationControllerPrivate::animationWillBeRemoved(AnimationBase& animation)
> {
>-    LOG(Animations, "CSSAnimationControllerPrivate %p animationWillBeRemoved: %p", this, animation);
>+    LOG(Animations, "CSSAnimationControllerPrivate %p animationWillBeRemoved: %p", this, &animation);
> 
>     removeFromAnimationsWaitingForStyle(animation);
>     removeFromAnimationsWaitingForStartTimeResponse(animation);
>diff --git a/Source/WebCore/page/animation/CSSAnimationControllerPrivate.h b/Source/WebCore/page/animation/CSSAnimationControllerPrivate.h
>index b324c61b33caff837f7471470792121d5a8fe0d2..55f586852c731e720ab3fba3259fa6032c55f5fb 100644
>--- a/Source/WebCore/page/animation/CSSAnimationControllerPrivate.h
>+++ b/Source/WebCore/page/animation/CSSAnimationControllerPrivate.h
>@@ -93,13 +93,13 @@ public:
>     void endAnimationUpdate();
>     void receivedStartTimeResponse(MonotonicTime);
>     
>-    void addToAnimationsWaitingForStyle(AnimationBase*);
>-    void removeFromAnimationsWaitingForStyle(AnimationBase*);
>+    void addToAnimationsWaitingForStyle(AnimationBase&);
>+    void removeFromAnimationsWaitingForStyle(AnimationBase&);
> 
>-    void addToAnimationsWaitingForStartTimeResponse(AnimationBase*, bool willGetResponse);
>-    void removeFromAnimationsWaitingForStartTimeResponse(AnimationBase*);
>+    void addToAnimationsWaitingForStartTimeResponse(AnimationBase&, bool willGetResponse);
>+    void removeFromAnimationsWaitingForStartTimeResponse(AnimationBase&);
> 
>-    void animationWillBeRemoved(AnimationBase*);
>+    void animationWillBeRemoved(AnimationBase&);
> 
>     void updateAnimationTimerForElement(Element&);
> 
>diff --git a/Source/WebCore/page/animation/CompositeAnimation.cpp b/Source/WebCore/page/animation/CompositeAnimation.cpp
>index 6f97aa5488201c69cbbae631083cf259277dbbb9..a7816317533e8806914b90dee0289bfb3a9a211b 100644
>--- a/Source/WebCore/page/animation/CompositeAnimation.cpp
>+++ b/Source/WebCore/page/animation/CompositeAnimation.cpp
>@@ -64,14 +64,14 @@ void CompositeAnimation::clearElement()
>         // Clear the renderers from all running animations, in case we are in the middle of
>         // an animation callback (see https://bugs.webkit.org/show_bug.cgi?id=22052)
>         for (auto& transition : m_transitions.values()) {
>-            animationController().animationWillBeRemoved(transition.get());
>+            animationController().animationWillBeRemoved(*transition);
>             transition->clear();
>         }
>     }
>     if (!m_keyframeAnimations.isEmpty()) {
>         m_keyframeAnimations.checkConsistency();
>         for (auto& animation : m_keyframeAnimations.values()) {
>-            animationController().animationWillBeRemoved(animation.get());
>+            animationController().animationWillBeRemoved(*animation);
>             animation->clear();
>         }
>     }
>@@ -159,7 +159,7 @@ void CompositeAnimation::updateTransitions(Element& element, const RenderStyle*
>                             implAnim->blendPropertyValueInStyle(prop, modifiedCurrentStyle.get());
>                         }
>                         LOG(Animations, "Removing existing ImplicitAnimation %p for property %s", implAnim, getPropertyName(prop));
>-                        animationController().animationWillBeRemoved(implAnim);
>+                        animationController().animationWillBeRemoved(*implAnim);
>                         m_transitions.remove(prop);
>                         equal = false;
>                     }
>@@ -193,7 +193,7 @@ void CompositeAnimation::updateTransitions(Element& element, const RenderStyle*
>     Vector<int> toBeRemoved;
>     for (auto& transition : m_transitions.values()) {
>         if (!transition->active()) {
>-            animationController().animationWillBeRemoved(transition.get());
>+            animationController().animationWillBeRemoved(*transition);
>             toBeRemoved.append(transition->animatingProperty());
>             LOG(Animations, "Removing ImplicitAnimation %p from element %p for property %s", transition.get(), &element, getPropertyName(transition->animatingProperty()));
>         }
>@@ -270,7 +270,7 @@ void CompositeAnimation::updateKeyframeAnimations(Element& element, const Render
>     // Make a list of animations to be removed.
>     for (auto& animation : m_keyframeAnimations.values()) {
>         if (!newAnimations.contains(animation->name().impl())) {
>-            animationController().animationWillBeRemoved(animation.get());
>+            animationController().animationWillBeRemoved(*animation);
>             animation->clear();
>             LOG(Animations, "Removing KeyframeAnimation %p from element %p", animation.get(), &element);
>         }
>diff --git a/Source/WebCore/page/ios/FrameIOS.mm b/Source/WebCore/page/ios/FrameIOS.mm
>index 05c85c66b8ee9e3f7f7e43bcc5702b0261fa64d9..4008cb358ff947677c055a6f1cbfcab34a50d301 100644
>--- a/Source/WebCore/page/ios/FrameIOS.mm
>+++ b/Source/WebCore/page/ios/FrameIOS.mm
>@@ -81,14 +81,14 @@ void Frame::initWithSimpleHTMLDocument(const String& style, const URL& url)
> {
>     m_loader->initForSynthesizedDocument(url);
> 
>-    auto document = HTMLDocument::createSynthesizedDocument(this, url);
>+    auto document = HTMLDocument::createSynthesizedDocument(*this, url);
>     document->setCompatibilityMode(DocumentCompatibilityMode::LimitedQuirksMode);
>     document->createDOMWindow();
>     setDocument(document.copyRef());
> 
>-    auto rootElement = HTMLHtmlElement::create(document.get());
>+    auto rootElement = HTMLHtmlElement::create(document);
> 
>-    auto body = HTMLBodyElement::create(document.get());
>+    auto body = HTMLBodyElement::create(document);
>     if (!style.isEmpty())
>         body->setAttribute(HTMLNames::styleAttr, style);
> 
>diff --git a/Source/WebCore/page/mac/EventHandlerMac.mm b/Source/WebCore/page/mac/EventHandlerMac.mm
>index 36745ec0c243831877cc3a46add3d9b1d714c87f..ba9f76528d81007252c814aaf9ba8c06a2885b25 100644
>--- a/Source/WebCore/page/mac/EventHandlerMac.mm
>+++ b/Source/WebCore/page/mac/EventHandlerMac.mm
>@@ -787,10 +787,10 @@ static ContainerNode* findEnclosingScrollableContainer(ContainerNode* node, floa
>     // Find the first node with a valid scrollable area starting with the current
>     // node and traversing its parents (or shadow hosts).
>     for (ContainerNode* candidate = node; candidate; candidate = candidate->parentOrShadowHostNode()) {
>-        if (is<HTMLIFrameElement>(candidate))
>+        if (is<HTMLIFrameElement>(*candidate))
>             continue;
> 
>-        if (is<HTMLHtmlElement>(candidate) || is<HTMLDocument>(candidate))
>+        if (is<HTMLHtmlElement>(*candidate) || is<HTMLDocument>(*candidate))
>             return nullptr;
> 
>         RenderBox* box = candidate->renderBox();
>diff --git a/Source/WebCore/rendering/CSSFilter.cpp b/Source/WebCore/rendering/CSSFilter.cpp
>index 84971b64a68485360901b0cf323e3cd83b6c0fbb..c004fc9e704a6ad32349fb824cdc5ddd03601b5c 100644
>--- a/Source/WebCore/rendering/CSSFilter.cpp
>+++ b/Source/WebCore/rendering/CSSFilter.cpp
>@@ -105,7 +105,7 @@ RefPtr<FilterEffect> CSSFilter::buildReferenceFilter(RenderElement& renderer, Fi
>         // Although we did not find the referenced filter, it might exist later in the document.
>         // FIXME: This skips anonymous RenderObjects. <https://webkit.org/b/131085>
>         if (auto* element = renderer.element())
>-            document->accessSVGExtensions().addPendingResource(filterOperation.fragment(), element);
>+            document->accessSVGExtensions().addPendingResource(filterOperation.fragment(), *element);
>         return nullptr;
>     }
> 
>diff --git a/Source/WebCore/rendering/svg/RenderSVGResource.cpp b/Source/WebCore/rendering/svg/RenderSVGResource.cpp
>index 0c5b679b0726522d3fb8e4d95d9ed477a48d4724..074f42f92ca83617e4a58006ed76940e6e3af4e9 100644
>--- a/Source/WebCore/rendering/svg/RenderSVGResource.cpp
>+++ b/Source/WebCore/rendering/svg/RenderSVGResource.cpp
>@@ -165,9 +165,9 @@ static inline void removeFromCacheAndInvalidateDependencies(RenderElement& rende
>             clipper->removeClientFromCache(renderer);
>     }
> 
>-    if (!renderer.element() || !renderer.element()->isSVGElement())
>+    if (!is<SVGElement>(renderer.element()))
>         return;
>-    HashSet<SVGElement*>* dependencies = renderer.document().accessSVGExtensions().setOfElementsReferencingTarget(downcast<SVGElement>(renderer.element()));
>+    auto* dependencies = renderer.document().accessSVGExtensions().setOfElementsReferencingTarget(downcast<SVGElement>(*renderer.element()));
>     if (!dependencies)
>         return;
> 
>diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
>index 0d1e3464da461622dfd398bfa6e1756cf9df73bd..931043538b8b8c955940070fe500079b207b4006 100644
>--- a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
>+++ b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
>@@ -171,19 +171,19 @@ void RenderSVGResourceContainer::registerResource()
> {
>     SVGDocumentExtensions& extensions = svgExtensionsFromElement(element());
>     if (!extensions.isIdOfPendingResource(m_id)) {
>-        extensions.addResource(m_id, this);
>+        extensions.addResource(m_id, *this);
>         return;
>     }
> 
>     std::unique_ptr<SVGDocumentExtensions::PendingElements> clients = extensions.removePendingResource(m_id);
> 
>     // Cache us with the new id.
>-    extensions.addResource(m_id, this);
>+    extensions.addResource(m_id, *this);
> 
>     // Update cached resources of pending clients.
>     for (auto* client : *clients) {
>         ASSERT(client->hasPendingResources());
>-        extensions.clearHasPendingResourcesIfPossible(client);
>+        extensions.clearHasPendingResourcesIfPossible(*client);
>         auto* renderer = client->renderer();
>         if (!renderer)
>             continue;
>diff --git a/Source/WebCore/rendering/svg/SVGResources.cpp b/Source/WebCore/rendering/svg/SVGResources.cpp
>index a2cc4bad9bf9856d61211d74e6576ff1bd09100c..2b06517ad75828a78a3b0ea2e67caab92c559ad0 100644
>--- a/Source/WebCore/rendering/svg/SVGResources.cpp
>+++ b/Source/WebCore/rendering/svg/SVGResources.cpp
>@@ -190,7 +190,7 @@ static inline RenderSVGResourceContainer* paintingResourceFromSVGPaint(Document&
> 
> static inline void registerPendingResource(SVGDocumentExtensions& extensions, const AtomicString& id, SVGElement& element)
> {
>-    extensions.addPendingResource(id, &element);
>+    extensions.addPendingResource(id, element);
> }
> 
> bool SVGResources::buildCachedResources(const RenderElement& renderer, const RenderStyle& style)
>diff --git a/Source/WebCore/rendering/svg/SVGResourcesCache.cpp b/Source/WebCore/rendering/svg/SVGResourcesCache.cpp
>index da24c07621000228563fcb583c04d05eec0212d4..19195aa1dabc66e4b3565972ec91f89477f4039b 100644
>--- a/Source/WebCore/rendering/svg/SVGResourcesCache.cpp
>+++ b/Source/WebCore/rendering/svg/SVGResourcesCache.cpp
>@@ -163,9 +163,8 @@ void SVGResourcesCache::resourceDestroyed(RenderSVGResourceContainer& resource)
>     for (auto& it : cache.m_cache) {
>         if (it.value->resourceDestroyed(resource)) {
>             // Mark users of destroyed resources as pending resolution based on the id of the old resource.
>-            Element& resourceElement = resource.element();
>-            Element* clientElement = it.key->element();
>-            clientElement->document().accessSVGExtensions().addPendingResource(resourceElement.getIdAttribute(), clientElement);
>+            auto& clientElement = *it.key->element();
>+            clientElement.document().accessSVGExtensions().addPendingResource(resource.element().getIdAttribute(), clientElement);
>         }
>     }
> }
>diff --git a/Source/WebCore/svg/SVGDocumentExtensions.cpp b/Source/WebCore/svg/SVGDocumentExtensions.cpp
>index 4ec1a8c85cb4512456a368a33a04735a2898e3c8..5c45335b5a5333088b5dfe42d4629ead6f5a8df8 100644
>--- a/Source/WebCore/svg/SVGDocumentExtensions.cpp
>+++ b/Source/WebCore/svg/SVGDocumentExtensions.cpp
>@@ -48,27 +48,25 @@ SVGDocumentExtensions::SVGDocumentExtensions(Document& document)
> 
> SVGDocumentExtensions::~SVGDocumentExtensions() = default;
> 
>-void SVGDocumentExtensions::addTimeContainer(SVGSVGElement* element)
>+void SVGDocumentExtensions::addTimeContainer(SVGSVGElement& element)
> {
>-    m_timeContainers.add(element);
>+    m_timeContainers.add(&element);
>     if (m_areAnimationsPaused)
>-        element->pauseAnimations();
>+        element.pauseAnimations();
> }
> 
>-void SVGDocumentExtensions::removeTimeContainer(SVGSVGElement* element)
>+void SVGDocumentExtensions::removeTimeContainer(SVGSVGElement& element)
> {
>-    m_timeContainers.remove(element);
>+    m_timeContainers.remove(&element);
> }
> 
>-void SVGDocumentExtensions::addResource(const AtomicString& id, RenderSVGResourceContainer* resource)
>+void SVGDocumentExtensions::addResource(const AtomicString& id, RenderSVGResourceContainer& resource)
> {
>-    ASSERT(resource);
>-
>     if (id.isEmpty())
>         return;
> 
>     // Replaces resource if already present, to handle potential id changes
>-    m_resources.set(id, resource);
>+    m_resources.set(id, &resource);
> }
> 
> void SVGDocumentExtensions::removeResource(const AtomicString& id)
>@@ -141,19 +139,17 @@ void SVGDocumentExtensions::reportError(const String& message)
>     reportMessage(m_document, MessageLevel::Error, "Error: " + message);
> }
> 
>-void SVGDocumentExtensions::addPendingResource(const AtomicString& id, Element* element)
>+void SVGDocumentExtensions::addPendingResource(const AtomicString& id, Element& element)
> {
>-    ASSERT(element);
>-
>     if (id.isEmpty())
>         return;
> 
>     auto result = m_pendingResources.add(id, nullptr);
>     if (result.isNewEntry)
>         result.iterator->value = std::make_unique<PendingElements>();
>-    result.iterator->value->add(element);
>+    result.iterator->value->add(&element);
> 
>-    element->setHasPendingResources();
>+    element.setHasPendingResources();
> }
> 
> bool SVGDocumentExtensions::isIdOfPendingResource(const AtomicString& id) const
>@@ -164,49 +160,43 @@ bool SVGDocumentExtensions::isIdOfPendingResource(const AtomicString& id) const
>     return m_pendingResources.contains(id);
> }
> 
>-bool SVGDocumentExtensions::isElementWithPendingResources(Element* element) const
>+bool SVGDocumentExtensions::isElementWithPendingResources(Element& element) const
> {
>     // This algorithm takes time proportional to the number of pending resources and need not.
>     // If performance becomes an issue we can keep a counted set of elements and answer the question efficiently.
>-    ASSERT(element);
>     for (auto& elements : m_pendingResources.values()) {
>         ASSERT(elements);
>-
>-        if (elements->contains(element))
>+        if (elements->contains(&element))
>             return true;
>     }
>     return false;
> }
> 
>-bool SVGDocumentExtensions::isPendingResource(Element* element, const AtomicString& id) const
>+bool SVGDocumentExtensions::isPendingResource(Element& element, const AtomicString& id) const
> {
>-    ASSERT(element);
>-
>     if (!isIdOfPendingResource(id))
>         return false;
> 
>-    return m_pendingResources.get(id)->contains(element);
>+    return m_pendingResources.get(id)->contains(&element);
> }
> 
>-void SVGDocumentExtensions::clearHasPendingResourcesIfPossible(Element* element)
>+void SVGDocumentExtensions::clearHasPendingResourcesIfPossible(Element& element)
> {
>     if (!isElementWithPendingResources(element))
>-        element->clearHasPendingResources();
>+        element.clearHasPendingResources();
> }
> 
>-void SVGDocumentExtensions::removeElementFromPendingResources(Element* element)
>+void SVGDocumentExtensions::removeElementFromPendingResources(Element& element)
> {
>-    ASSERT(element);
>-
>     // Remove the element from pending resources.
>-    if (!m_pendingResources.isEmpty() && element->hasPendingResources()) {
>+    if (!m_pendingResources.isEmpty() && element.hasPendingResources()) {
>         Vector<AtomicString> toBeRemoved;
>         for (auto& resource : m_pendingResources) {
>             PendingElements* elements = resource.value.get();
>             ASSERT(elements);
>             ASSERT(!elements->isEmpty());
> 
>-            elements->remove(element);
>+            elements->remove(&element);
>             if (elements->isEmpty())
>                 toBeRemoved.append(resource.key);
>         }
>@@ -226,7 +216,7 @@ void SVGDocumentExtensions::removeElementFromPendingResources(Element* element)
>             ASSERT(elements);
>             ASSERT(!elements->isEmpty());
> 
>-            elements->remove(element);
>+            elements->remove(&element);
>             if (elements->isEmpty())
>                 toBeRemoved.append(resource.key);
>         }
>@@ -281,40 +271,29 @@ RefPtr<Element> SVGDocumentExtensions::removeElementFromPendingResourcesForRemov
>     return element;
> }
> 
>-HashSet<SVGElement*>* SVGDocumentExtensions::setOfElementsReferencingTarget(SVGElement* referencedElement) const
>+HashSet<SVGElement*>* SVGDocumentExtensions::setOfElementsReferencingTarget(SVGElement& referencedElement) const
> {
>-    ASSERT(referencedElement);
>-    const auto it = m_elementDependencies.find(referencedElement);
>-    if (it == m_elementDependencies.end())
>-        return 0;
>-    return it->value.get();
>+    return m_elementDependencies.get(&referencedElement);
> }
> 
>-void SVGDocumentExtensions::addElementReferencingTarget(SVGElement* referencingElement, SVGElement* referencedElement)
>+void SVGDocumentExtensions::addElementReferencingTarget(SVGElement& referencingElement, SVGElement& referencedElement)
> {
>-    ASSERT(referencingElement);
>-    ASSERT(referencedElement);
>-
>-    if (HashSet<SVGElement*>* elements = m_elementDependencies.get(referencedElement)) {
>-        elements->add(referencingElement);
>-        return;
>-    }
>-
>-    auto elements = std::make_unique<HashSet<SVGElement*>>();
>-    elements->add(referencingElement);
>-    m_elementDependencies.set(referencedElement, WTFMove(elements));
>+    auto result = m_elementDependencies.ensure(&referencedElement, [&referencingElement] {
>+        return std::make_unique<HashSet<SVGElement*>>(std::initializer_list<SVGElement*> { &referencingElement });
>+    });
>+    if (!result.isNewEntry)
>+        result.iterator->value->add(&referencingElement);
> }
> 
>-void SVGDocumentExtensions::removeAllTargetReferencesForElement(SVGElement* referencingElement)
>+void SVGDocumentExtensions::removeAllTargetReferencesForElement(SVGElement& referencingElement)
> {
>     Vector<SVGElement*> toBeRemoved;
> 
>     for (auto& dependency : m_elementDependencies) {
>-        SVGElement* referencedElement = dependency.key;
>-        HashSet<SVGElement*>& referencingElements = *dependency.value;
>-        referencingElements.remove(referencingElement);
>+        auto& referencingElements = *dependency.value;
>+        referencingElements.remove(&referencingElement);
>         if (referencingElements.isEmpty())
>-            toBeRemoved.append(referencedElement);
>+            toBeRemoved.append(dependency.key);
>     }
> 
>     for (auto& element : toBeRemoved)
>@@ -330,11 +309,9 @@ void SVGDocumentExtensions::rebuildElements()
> 
> void SVGDocumentExtensions::clearTargetDependencies(SVGElement& referencedElement)
> {
>-    auto it = m_elementDependencies.find(&referencedElement);
>-    if (it == m_elementDependencies.end())
>+    auto* referencingElements = m_elementDependencies.get(&referencedElement);
>+    if (!referencingElements)
>         return;
>-    ASSERT(it->key == &referencedElement);
>-    HashSet<SVGElement*>* referencingElements = it->value.get();
>     for (auto* element : *referencingElements) {
>         m_rebuildElements.append(element);
>         element->callClearTarget();
>@@ -358,23 +335,25 @@ void SVGDocumentExtensions::rebuildAllElementReferencesForTarget(SVGElement& ref
>         element->svgAttributeChanged(SVGNames::hrefAttr);
> }
> 
>-void SVGDocumentExtensions::removeAllElementReferencesForTarget(SVGElement* referencedElement)
>+void SVGDocumentExtensions::removeAllElementReferencesForTarget(SVGElement& referencedElement)
> {
>-    m_elementDependencies.remove(referencedElement);
>-    m_rebuildElements.removeFirst(referencedElement);
>+    m_elementDependencies.remove(&referencedElement);
>+    m_rebuildElements.removeFirst(&referencedElement);
> }
> 
> #if ENABLE(SVG_FONTS)
>-void SVGDocumentExtensions::registerSVGFontFaceElement(SVGFontFaceElement* element)
>+
>+void SVGDocumentExtensions::registerSVGFontFaceElement(SVGFontFaceElement& element)
> {
>-    m_svgFontFaceElements.add(element);
>+    m_svgFontFaceElements.add(&element);
> }
> 
>-void SVGDocumentExtensions::unregisterSVGFontFaceElement(SVGFontFaceElement* element)
>+void SVGDocumentExtensions::unregisterSVGFontFaceElement(SVGFontFaceElement& element)
> {
>-    ASSERT(m_svgFontFaceElements.contains(element));
>-    m_svgFontFaceElements.remove(element);
>+    ASSERT(m_svgFontFaceElements.contains(&element));
>+    m_svgFontFaceElements.remove(&element);
> }
>+
> #endif
> 
> }
>diff --git a/Source/WebCore/svg/SVGDocumentExtensions.h b/Source/WebCore/svg/SVGDocumentExtensions.h
>index ef72e9765ec67c1823b0c3dd3fd574365e7950ed..c49f2dc73d21aeb36a118c71a78e50254bf9a334 100644
>--- a/Source/WebCore/svg/SVGDocumentExtensions.h
>+++ b/Source/WebCore/svg/SVGDocumentExtensions.h
>@@ -43,10 +43,10 @@ public:
>     explicit SVGDocumentExtensions(Document&);
>     ~SVGDocumentExtensions();
>     
>-    void addTimeContainer(SVGSVGElement*);
>-    void removeTimeContainer(SVGSVGElement*);
>+    void addTimeContainer(SVGSVGElement&);
>+    void removeTimeContainer(SVGSVGElement&);
> 
>-    void addResource(const AtomicString& id, RenderSVGResourceContainer*);
>+    void addResource(const AtomicString& id, RenderSVGResourceContainer&);
>     void removeResource(const AtomicString& id);
>     RenderSVGResourceContainer* resourceById(const AtomicString& id) const;
> 
>@@ -61,19 +61,19 @@ public:
> 
>     SVGResourcesCache& resourcesCache() { return *m_resourcesCache; }
> 
>-    HashSet<SVGElement*>* setOfElementsReferencingTarget(SVGElement* referencedElement) const;
>-    void addElementReferencingTarget(SVGElement* referencingElement, SVGElement* referencedElement);
>-    void removeAllTargetReferencesForElement(SVGElement*);
>+    HashSet<SVGElement*>* setOfElementsReferencingTarget(SVGElement& referencedElement) const;
>+    void addElementReferencingTarget(SVGElement& referencingElement, SVGElement& referencedElement);
>+    void removeAllTargetReferencesForElement(SVGElement&);
>     void rebuildAllElementReferencesForTarget(SVGElement&);
>-    void removeAllElementReferencesForTarget(SVGElement*);
>+    void removeAllElementReferencesForTarget(SVGElement&);
> 
>     void clearTargetDependencies(SVGElement&);
>     void rebuildElements();
> 
> #if ENABLE(SVG_FONTS)
>     const HashSet<SVGFontFaceElement*>& svgFontFaceElements() const { return m_svgFontFaceElements; }
>-    void registerSVGFontFaceElement(SVGFontFaceElement*);
>-    void unregisterSVGFontFaceElement(SVGFontFaceElement*);
>+    void registerSVGFontFaceElement(SVGFontFaceElement&);
>+    void unregisterSVGFontFaceElement(SVGFontFaceElement&);
> #endif
> 
> private:
>@@ -95,11 +95,11 @@ public:
>     // This HashMap contains a list of pending resources. Pending resources, are such
>     // which are referenced by any object in the SVG document, but do NOT exist yet.
>     // For instance, dynamically build gradients / patterns / clippers...
>-    void addPendingResource(const AtomicString& id, Element*);
>+    void addPendingResource(const AtomicString& id, Element&);
>     bool isIdOfPendingResource(const AtomicString& id) const;
>-    bool isPendingResource(Element*, const AtomicString& id) const;
>-    void clearHasPendingResourcesIfPossible(Element*);
>-    void removeElementFromPendingResources(Element*);
>+    bool isPendingResource(Element&, const AtomicString& id) const;
>+    void clearHasPendingResourcesIfPossible(Element&);
>+    void removeElementFromPendingResources(Element&);
>     std::unique_ptr<PendingElements> removePendingResource(const AtomicString& id);
> 
>     // The following two functions are used for scheduling a pending resource to be removed.
>@@ -107,7 +107,7 @@ public:
>     RefPtr<Element> removeElementFromPendingResourcesForRemovalMap(const AtomicString&);
> 
> private:
>-    bool isElementWithPendingResources(Element*) const;
>+    bool isElementWithPendingResources(Element&) const;
>     std::unique_ptr<PendingElements> removePendingResourceForRemoval(const AtomicString&);
> };
> 
>diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
>index 4f9f0d4d4cea3261d972792f561854577a13ca6d..12ee77c00d9252d67477cdef1ba1b2d90d5b559a 100644
>--- a/Source/WebCore/svg/SVGElement.cpp
>+++ b/Source/WebCore/svg/SVGElement.cpp
>@@ -290,7 +290,7 @@ SVGElement::~SVGElement()
>         m_svgRareData = nullptr;
>     }
>     document().accessSVGExtensions().rebuildAllElementReferencesForTarget(*this);
>-    document().accessSVGExtensions().removeAllElementReferencesForTarget(this);
>+    document().accessSVGExtensions().removeAllElementReferencesForTarget(*this);
> }
> 
> int SVGElement::tabIndex() const
>@@ -370,7 +370,7 @@ void SVGElement::removedFromAncestor(RemovalType removalType, ContainerNode& old
> 
>     if (removalType.disconnectedFromDocument) {
>         document().accessSVGExtensions().clearTargetDependencies(*this);
>-        document().accessSVGExtensions().removeAllElementReferencesForTarget(this);
>+        document().accessSVGExtensions().removeAllElementReferencesForTarget(*this);
>     }
>     invalidateInstances();
> }
>@@ -992,7 +992,7 @@ void SVGElement::buildPendingResourcesIfNeeded()
>         ASSERT(clientElement->hasPendingResources());
>         if (clientElement->hasPendingResources()) {
>             clientElement->buildPendingResource();
>-            extensions.clearHasPendingResourcesIfPossible(clientElement.get());
>+            extensions.clearHasPendingResourcesIfPossible(*clientElement);
>         }
>     }
> }
>diff --git a/Source/WebCore/svg/SVGFEImageElement.cpp b/Source/WebCore/svg/SVGFEImageElement.cpp
>index 65cfde1de7726ad7b9b234e5c39d46ddb7c330a1..5da0d49e3a8d6f239420ae53bf8fd917b11723da 100644
>--- a/Source/WebCore/svg/SVGFEImageElement.cpp
>+++ b/Source/WebCore/svg/SVGFEImageElement.cpp
>@@ -72,7 +72,7 @@ void SVGFEImageElement::clearResourceReferences()
>         m_cachedImage = nullptr;
>     }
> 
>-    document().accessSVGExtensions().removeAllTargetReferencesForElement(this);
>+    document().accessSVGExtensions().removeAllTargetReferencesForElement(*this);
> }
> 
> void SVGFEImageElement::requestImageResource()
>@@ -99,13 +99,13 @@ void SVGFEImageElement::buildPendingResource()
>         if (target.identifier.isEmpty())
>             requestImageResource();
>         else {
>-            document().accessSVGExtensions().addPendingResource(target.identifier, this);
>+            document().accessSVGExtensions().addPendingResource(target.identifier, *this);
>             ASSERT(hasPendingResources());
>         }
>-    } else if (target.element->isSVGElement()) {
>+    } else if (is<SVGElement>(*target.element)) {
>         // Register us with the target in the dependencies map. Any change of hrefElement
>         // that leads to relayout/repainting now informs us, so we can react to it.
>-        document().accessSVGExtensions().addElementReferencingTarget(this, downcast<SVGElement>(target.element.get()));
>+        document().accessSVGExtensions().addElementReferencingTarget(*this, downcast<SVGElement>(*target.element));
>     }
> 
>     invalidate();
>diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
>index fe3b619530d510b5572ae25a0a14cbd80b8b69f7..33b6b78a851124c3d3b7cfe79b50958a35b0ec5c 100644
>--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
>+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
>@@ -304,7 +304,7 @@ Node::InsertedIntoAncestorResult SVGFontFaceElement::insertedIntoAncestor(Insert
>         ASSERT(!m_fontElement);
>         return InsertedIntoAncestorResult::Done;
>     }
>-    document().accessSVGExtensions().registerSVGFontFaceElement(this);
>+    document().accessSVGExtensions().registerSVGFontFaceElement(*this);
> 
>     rebuildFontFace();
>     return InsertedIntoAncestorResult::Done;
>@@ -316,7 +316,7 @@ void SVGFontFaceElement::removedFromAncestor(RemovalType removalType, ContainerN
> 
>     if (removalType.disconnectedFromDocument) {
>         m_fontElement = nullptr;
>-        document().accessSVGExtensions().unregisterSVGFontFaceElement(this);
>+        document().accessSVGExtensions().unregisterSVGFontFaceElement(*this);
>         m_fontFaceRule->mutableProperties().clear();
> 
>         document().styleScope().didChangeStyleSheetEnvironment();
>diff --git a/Source/WebCore/svg/SVGMPathElement.cpp b/Source/WebCore/svg/SVGMPathElement.cpp
>index 18e9dd516f35756d58b9fc44c5a63c4f3a067b04..60ba714753498d6813ffdb8879f6ca7d6d11b128 100644
>--- a/Source/WebCore/svg/SVGMPathElement.cpp
>+++ b/Source/WebCore/svg/SVGMPathElement.cpp
>@@ -58,17 +58,17 @@ void SVGMPathElement::buildPendingResource()
>     auto target = SVGURIReference::targetElementFromIRIString(href(), treeScope());
>     if (!target.element) {
>         // Do not register as pending if we are already pending this resource.
>-        if (document().accessSVGExtensions().isPendingResource(this, target.identifier))
>+        if (document().accessSVGExtensions().isPendingResource(*this, target.identifier))
>             return;
> 
>         if (!target.identifier.isEmpty()) {
>-            document().accessSVGExtensions().addPendingResource(target.identifier, this);
>+            document().accessSVGExtensions().addPendingResource(target.identifier, *this);
>             ASSERT(hasPendingResources());
>         }
>-    } else if (target.element->isSVGElement()) {
>+    } else if (is<SVGElement>(*target.element)) {
>         // Register us with the target in the dependencies map. Any change of hrefElement
>         // that leads to relayout/repainting now informs us, so we can react to it.
>-        document().accessSVGExtensions().addElementReferencingTarget(this, downcast<SVGElement>(target.element.get()));
>+        document().accessSVGExtensions().addElementReferencingTarget(*this, downcast<SVGElement>(*target.element));
>     }
> 
>     targetPathChanged();
>@@ -76,7 +76,7 @@ void SVGMPathElement::buildPendingResource()
> 
> void SVGMPathElement::clearResourceReferences()
> {
>-    document().accessSVGExtensions().removeAllTargetReferencesForElement(this);
>+    document().accessSVGExtensions().removeAllTargetReferencesForElement(*this);
> }
> 
> Node::InsertedIntoAncestorResult SVGMPathElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
>diff --git a/Source/WebCore/svg/SVGPathElement.cpp b/Source/WebCore/svg/SVGPathElement.cpp
>index a28e71452cc82c6107734bcdbc7e475fc3cbfc33..a777b8ddaddbbc0d8a1037318af8ab3bead3f29d 100644
>--- a/Source/WebCore/svg/SVGPathElement.cpp
>+++ b/Source/WebCore/svg/SVGPathElement.cpp
>@@ -237,7 +237,7 @@ void SVGPathElement::invalidateMPathDependencies()
> {
>     // <mpath> can only reference <path> but this dependency is not handled in
>     // markForLayoutAndParentResourceInvalidation so we update any mpath dependencies manually.
>-    if (HashSet<SVGElement*>* dependencies = document().accessSVGExtensions().setOfElementsReferencingTarget(this)) {
>+    if (HashSet<SVGElement*>* dependencies = document().accessSVGExtensions().setOfElementsReferencingTarget(*this)) {
>         for (auto* element : *dependencies) {
>             if (is<SVGMPathElement>(*element))
>                 downcast<SVGMPathElement>(*element).targetPathChanged();
>diff --git a/Source/WebCore/svg/SVGSVGElement.cpp b/Source/WebCore/svg/SVGSVGElement.cpp
>index 16171a305ed3cc48e80c858e9c56c9a674caa270..4d14415cd59a7e2c065a8eac16dd9552ae7c568f 100644
>--- a/Source/WebCore/svg/SVGSVGElement.cpp
>+++ b/Source/WebCore/svg/SVGSVGElement.cpp
>@@ -60,7 +60,7 @@ inline SVGSVGElement::SVGSVGElement(const QualifiedName& tagName, Document& docu
> {
>     ASSERT(hasTagName(SVGNames::svgTag));
>     registerAttributes();
>-    document.registerForDocumentSuspensionCallbacks(this);
>+    document.registerForDocumentSuspensionCallbacks(*this);
> }
> 
> Ref<SVGSVGElement> SVGSVGElement::create(const QualifiedName& tagName, Document& document)
>@@ -77,14 +77,14 @@ SVGSVGElement::~SVGSVGElement()
> {
>     if (m_viewSpec)
>         m_viewSpec->resetContextElement();
>-    document().unregisterForDocumentSuspensionCallbacks(this);
>-    document().accessSVGExtensions().removeTimeContainer(this);
>+    document().unregisterForDocumentSuspensionCallbacks(*this);
>+    document().accessSVGExtensions().removeTimeContainer(*this);
> }
> 
> void SVGSVGElement::didMoveToNewDocument(Document& oldDocument, Document& newDocument)
> {
>-    oldDocument.unregisterForDocumentSuspensionCallbacks(this);
>-    document().registerForDocumentSuspensionCallbacks(this);
>+    oldDocument.unregisterForDocumentSuspensionCallbacks(*this);
>+    document().registerForDocumentSuspensionCallbacks(*this);
>     SVGGraphicsElement::didMoveToNewDocument(oldDocument, newDocument);
> }
> 
>@@ -474,7 +474,7 @@ RenderPtr<RenderElement> SVGSVGElement::createElementRenderer(RenderStyle&& styl
> Node::InsertedIntoAncestorResult SVGSVGElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
> {
>     if (insertionType.connectedToDocument) {
>-        document().accessSVGExtensions().addTimeContainer(this);
>+        document().accessSVGExtensions().addTimeContainer(*this);
>         if (!document().accessSVGExtensions().areAnimationsPaused())
>             unpauseAnimations();
> 
>@@ -490,7 +490,7 @@ Node::InsertedIntoAncestorResult SVGSVGElement::insertedIntoAncestor(InsertionTy
> void SVGSVGElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
> {
>     if (removalType.disconnectedFromDocument) {
>-        document().accessSVGExtensions().removeTimeContainer(this);
>+        document().accessSVGExtensions().removeTimeContainer(*this);
>         pauseAnimations();
>     }
>     SVGGraphicsElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
>diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
>index b73f3cf878f9e895c6d53bfc58f01d86d5313022..823f1f023532a06387ea61365d0797dd5b02c581 100644
>--- a/Source/WebCore/svg/SVGTRefElement.cpp
>+++ b/Source/WebCore/svg/SVGTRefElement.cpp
>@@ -169,7 +169,7 @@ void SVGTRefElement::detachTarget()
>     // Mark the referenced ID as pending.
>     auto target = SVGURIReference::targetElementFromIRIString(href(), document());
>     if (!target.identifier.isEmpty())
>-        document().accessSVGExtensions().addPendingResource(target.identifier, this);
>+        document().accessSVGExtensions().addPendingResource(target.identifier, *this);
> }
> 
> void SVGTRefElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
>@@ -235,7 +235,7 @@ void SVGTRefElement::buildPendingResource()
>         if (target.identifier.isEmpty())
>             return;
> 
>-        document().accessSVGExtensions().addPendingResource(target.identifier, this);
>+        document().accessSVGExtensions().addPendingResource(target.identifier, *this);
>         ASSERT(hasPendingResources());
>         return;
>     }
>diff --git a/Source/WebCore/svg/SVGTextPathElement.cpp b/Source/WebCore/svg/SVGTextPathElement.cpp
>index a1191f901a304823a5317ea657113502bb45e0c2..55895a96de783c14c772888915157ab6dc41d425 100644
>--- a/Source/WebCore/svg/SVGTextPathElement.cpp
>+++ b/Source/WebCore/svg/SVGTextPathElement.cpp
>@@ -53,7 +53,7 @@ SVGTextPathElement::~SVGTextPathElement()
> 
> void SVGTextPathElement::clearResourceReferences()
> {
>-    document().accessSVGExtensions().removeAllTargetReferencesForElement(this);
>+    document().accessSVGExtensions().removeAllTargetReferencesForElement(*this);
> }
> 
> void SVGTextPathElement::registerAttributes()
>@@ -146,17 +146,17 @@ void SVGTextPathElement::buildPendingResource()
>     auto target = SVGURIReference::targetElementFromIRIString(href(), treeScope());
>     if (!target.element) {
>         // Do not register as pending if we are already pending this resource.
>-        if (document().accessSVGExtensions().isPendingResource(this, target.identifier))
>+        if (document().accessSVGExtensions().isPendingResource(*this, target.identifier))
>             return;
> 
>         if (!target.identifier.isEmpty()) {
>-            document().accessSVGExtensions().addPendingResource(target.identifier, this);
>+            document().accessSVGExtensions().addPendingResource(target.identifier, *this);
>             ASSERT(hasPendingResources());
>         }
>     } else if (target.element->hasTagName(SVGNames::pathTag)) {
>         // Register us with the target in the dependencies map. Any change of hrefElement
>         // that leads to relayout/repainting now informs us, so we can react to it.
>-        document().accessSVGExtensions().addElementReferencingTarget(this, downcast<SVGElement>(target.element.get()));
>+        document().accessSVGExtensions().addElementReferencingTarget(*this, downcast<SVGElement>(*target.element));
>     }
> }
> 
>diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
>index bbcc4378852068ce3f23705e2d6b74ec23fab549..06142a4cfc99979a48dbae64ac216e7292bc056e 100644
>--- a/Source/WebCore/svg/SVGUseElement.cpp
>+++ b/Source/WebCore/svg/SVGUseElement.cpp
>@@ -240,7 +240,7 @@ void SVGUseElement::updateShadowTree()
>     String targetID;
>     auto* target = findTarget(&targetID);
>     if (!target) {
>-        document().accessSVGExtensions().addPendingResource(targetID, this);
>+        document().accessSVGExtensions().addPendingResource(targetID, *this);
>         return;
>     }
> 
>diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
>index bbda240ac1f2b64688e5afa733e97275d6051bc1..c12e9ead4b8c9fde86800138fdc0e9501b51bfb8 100644
>--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
>+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
>@@ -161,7 +161,7 @@ SVGSMILElement::~SVGSMILElement()
> 
> void SVGSMILElement::clearResourceReferences()
> {
>-    document().accessSVGExtensions().removeAllTargetReferencesForElement(this);
>+    document().accessSVGExtensions().removeAllTargetReferencesForElement(*this);
> }
> 
> void SVGSMILElement::clearTarget()
>@@ -199,17 +199,17 @@ void SVGSMILElement::buildPendingResource()
> 
>     if (!svgTarget) {
>         // Do not register as pending if we are already pending this resource.
>-        if (document().accessSVGExtensions().isPendingResource(this, id))
>+        if (document().accessSVGExtensions().isPendingResource(*this, id))
>             return;
> 
>         if (!id.isEmpty()) {
>-            document().accessSVGExtensions().addPendingResource(id, this);
>+            document().accessSVGExtensions().addPendingResource(id, *this);
>             ASSERT(hasPendingResources());
>         }
>     } else {
>         // Register us with the target in the dependencies map. Any change of hrefElement
>         // that leads to relayout/repainting now informs us, so we can react to it.
>-        document().accessSVGExtensions().addElementReferencingTarget(this, svgTarget);
>+        document().accessSVGExtensions().addElementReferencingTarget(*this, *svgTarget);
>     }
> }
> 
>diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
>index 3099971f337f6090f842a4ff921f5b5c923bc668..1c84704b7b3965298a872894bcfad2e12b4da602 100644
>--- a/Source/WebCore/testing/Internals.cpp
>+++ b/Source/WebCore/testing/Internals.cpp
>@@ -1610,7 +1610,7 @@ ExceptionOr<String> Internals::dumpMarkerRects(const String& markerTypeString)
> void Internals::addTextMatchMarker(const Range& range, bool isActive)
> {
>     range.ownerDocument().updateLayoutIgnorePendingStylesheets();
>-    range.ownerDocument().markers().addTextMatchMarker(&range, isActive);
>+    range.ownerDocument().markers().addTextMatchMarker(range, isActive);
> }
> 
> ExceptionOr<void> Internals::setMarkedTextMatchesAreHighlighted(bool flag)
>@@ -2920,31 +2920,31 @@ void Internals::webkitWillEnterFullScreenForElement(Element& element)
>     Document* document = contextDocument();
>     if (!document)
>         return;
>-    document->webkitWillEnterFullScreenForElement(&element);
>+    document->webkitWillEnterFullScreen(element);
> }
> 
>-void Internals::webkitDidEnterFullScreenForElement(Element& element)
>+void Internals::webkitDidEnterFullScreenForElement(Element&)
> {
>     Document* document = contextDocument();
>     if (!document)
>         return;
>-    document->webkitDidEnterFullScreenForElement(&element);
>+    document->webkitDidEnterFullScreen();
> }
> 
>-void Internals::webkitWillExitFullScreenForElement(Element& element)
>+void Internals::webkitWillExitFullScreenForElement(Element&)
> {
>     Document* document = contextDocument();
>     if (!document)
>         return;
>-    document->webkitWillExitFullScreenForElement(&element);
>+    document->webkitWillExitFullScreen();
> }
> 
>-void Internals::webkitDidExitFullScreenForElement(Element& element)
>+void Internals::webkitDidExitFullScreenForElement(Element&)
> {
>     Document* document = contextDocument();
>     if (!document)
>         return;
>-    document->webkitDidExitFullScreenForElement(&element);
>+    document->webkitDidExitFullScreen();
> }
> 
> bool Internals::isAnimatingFullScreen() const
>diff --git a/Source/WebCore/workers/Worker.cpp b/Source/WebCore/workers/Worker.cpp
>index 49474c7042d3f0f9a4ba6fe366a30a383840bd80..6486338bc7174a52e5e065cfe85539497385686c 100644
>--- a/Source/WebCore/workers/Worker.cpp
>+++ b/Source/WebCore/workers/Worker.cpp
>@@ -93,7 +93,7 @@ ExceptionOr<Ref<Worker>> Worker::create(ScriptExecutionContext& context, JSC::Ru
>     worker->m_shouldBypassMainWorldContentSecurityPolicy = shouldBypassMainWorldContentSecurityPolicy;
> 
>     // The worker context does not exist while loading, so we must ensure that the worker object is not collected, nor are its event listeners.
>-    worker->setPendingActivity(worker.ptr());
>+    worker->setPendingActivity(worker.get());
> 
>     // https://html.spec.whatwg.org/multipage/workers.html#official-moment-of-creation
>     worker->m_workerCreationTime = MonotonicTime::now();
>@@ -191,7 +191,7 @@ void Worker::notifyFinished()
>     }
>     m_scriptLoader = nullptr;
> 
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/workers/service/ServiceWorkerContainer.cpp b/Source/WebCore/workers/service/ServiceWorkerContainer.cpp
>index 7a96d978cc9b833b92326e082b39680fe2953177..7442dd45537f1f4f4aead62652e36a74609d990b 100644
>--- a/Source/WebCore/workers/service/ServiceWorkerContainer.cpp
>+++ b/Source/WebCore/workers/service/ServiceWorkerContainer.cpp
>@@ -239,7 +239,7 @@ void ServiceWorkerContainer::scheduleJob(Ref<ServiceWorkerJob>&& job)
> 
>     ASSERT(m_swConnection);
> 
>-    setPendingActivity(this);
>+    setPendingActivity(*this);
> 
>     auto& jobData = job->data();
>     auto result = m_jobMap.add(job->identifier(), WTFMove(job));
>@@ -558,7 +558,7 @@ void ServiceWorkerContainer::jobDidFinish(ServiceWorkerJob& job)
>     auto taken = m_jobMap.take(job.identifier());
>     ASSERT_UNUSED(taken, !taken || taken->ptr() == &job);
> 
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
> 
> SWServerConnectionIdentifier ServiceWorkerContainer::connectionIdentifier()
>diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
>index 0dd7152bbddc374ecfa889d06e997fbfd191a868..5116457da85ff17341431f6da5f88ec6773955e4 100644
>--- a/Source/WebCore/xml/XMLHttpRequest.cpp
>+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
>@@ -197,9 +197,9 @@ ExceptionOr<Document*> XMLHttpRequest::responseXML()
>             m_responseDocument = nullptr;
>         } else {
>             if (isHTML)
>-                m_responseDocument = HTMLDocument::create(0, m_url);
>+                m_responseDocument = HTMLDocument::create(nullptr, m_url);
>             else
>-                m_responseDocument = XMLDocument::create(0, m_url);
>+                m_responseDocument = XMLDocument::create(nullptr, m_url);
>             m_responseDocument->overrideLastModified(m_response.lastModified());
>             m_responseDocument->setContent(m_responseBuilder.toStringPreserveCapacity());
>             m_responseDocument->setContextDocument(downcast<Document>(*scriptExecutionContext()));
>@@ -429,7 +429,7 @@ Optional<ExceptionOr<void>> XMLHttpRequest::prepareToSend()
>     if (!context.shouldBypassMainWorldContentSecurityPolicy() && !context.contentSecurityPolicy()->allowConnectToSource(m_url)) {
>         if (!m_async)
>             return ExceptionOr<void> { Exception { NetworkError } };
>-        setPendingActivity(this);
>+        setPendingActivity(*this);
>         m_timeoutTimer.stop();
>         m_networkErrorTimer.startOneShot(0_s);
>         return ExceptionOr<void> { };
>@@ -652,7 +652,7 @@ ExceptionOr<void> XMLHttpRequest::createRequest()
>         // a request is in progress because we need to keep the listeners alive,
>         // and they are referenced by the JavaScript wrapper.
>         if (m_loader)
>-            setPendingActivity(this);
>+            setPendingActivity(*this);
>     } else {
>         request.setDomainForCachePartition(scriptExecutionContext()->domainForCachePartition());
>         InspectorInstrumentation::willLoadXHRSynchronously(scriptExecutionContext());
>@@ -715,7 +715,7 @@ bool XMLHttpRequest::internalAbort()
>     // Save this information to a local variable since we are going to drop protection.
>     bool newLoadStarted = m_loader;
> 
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> 
>     return !newLoadStarted;
> }
>@@ -762,7 +762,7 @@ void XMLHttpRequest::networkError()
> void XMLHttpRequest::networkErrorTimerFired()
> {
>     networkError();
>-    unsetPendingActivity(this);
>+    unsetPendingActivity(*this);
> }
>     
> void XMLHttpRequest::abortError()
>@@ -913,7 +913,7 @@ void XMLHttpRequest::didFail(const ResourceError& error)
>     // In case didFail is called synchronously on an asynchronous XHR call, let's dispatch network error asynchronously
>     if (m_async && m_sendFlag && !m_loader) {
>         m_sendFlag = false;
>-        setPendingActivity(this);
>+        setPendingActivity(*this);
>         m_timeoutTimer.stop();
>         m_networkErrorTimer.startOneShot(0_s);
>         return;
>@@ -946,7 +946,7 @@ void XMLHttpRequest::didFinishLoading(unsigned long)
>     m_timeoutTimer.stop();
> 
>     if (hadLoader)
>-        unsetPendingActivity(this);
>+        unsetPendingActivity(*this);
> }
> 
> void XMLHttpRequest::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
>diff --git a/Source/WebCore/xml/XPathStep.cpp b/Source/WebCore/xml/XPathStep.cpp
>index aa40c2170fe7370c424fa40f710e601788646004..4b55917a371b6aa6c24f2d350fce997d0ed9e9f5 100644
>--- a/Source/WebCore/xml/XPathStep.cpp
>+++ b/Source/WebCore/xml/XPathStep.cpp
>@@ -30,7 +30,6 @@
> 
> #include "Attr.h"
> #include "Document.h"
>-#include "HTMLDocument.h"
> #include "HTMLElement.h"
> #include "NodeTraversal.h"
> #include "XMLNSNames.h"
>@@ -199,7 +198,7 @@ inline bool nodeMatchesBasicTest(Node& node, Step::Axis axis, const Step::NodeTe
>             if (name == starAtom())
>                 return namespaceURI.isEmpty() || namespaceURI == node.namespaceURI();
> 
>-            if (is<HTMLDocument>(node.document())) {
>+            if (node.document().isHTMLDocument()) {
>                 if (is<HTMLElement>(node)) {
>                     // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace. Names are compared case-insensitively.
>                     return equalIgnoringASCIICase(downcast<HTMLElement>(node).localName(), name) && (namespaceURI.isNull() || namespaceURI == node.namespaceURI());
>diff --git a/Source/WebCore/xml/XSLTProcessor.cpp b/Source/WebCore/xml/XSLTProcessor.cpp
>index 99017abeb59933c30eac02e682c5246b2017c956..a68acd75dbe2bf21eadceba05113a882a20ded81 100644
>--- a/Source/WebCore/xml/XSLTProcessor.cpp
>+++ b/Source/WebCore/xml/XSLTProcessor.cpp
>@@ -21,11 +21,10 @@
>  */
> 
> #include "config.h"
>+#include "XSLTProcessor.h"
> 
> #if ENABLE(XSLT)
> 
>-#include "XSLTProcessor.h"
>-
> #include "DOMImplementation.h"
> #include "CachedResourceLoader.h"
> #include "ContentSecurityPolicy.h"
>@@ -33,7 +32,6 @@
> #include "Frame.h"
> #include "FrameLoader.h"
> #include "FrameView.h"
>-#include "HTMLDocument.h"
> #include "SecurityOrigin.h"
> #include "SecurityOriginPolicy.h"
> #include "Text.h"
>@@ -87,7 +85,7 @@ Ref<Document> XSLTProcessor::createDocumentFromSource(const String& sourceString
> 
>         if (Document* oldDocument = frame->document()) {
>             result->setTransformSourceDocument(oldDocument);
>-            result->takeDOMWindowFrom(oldDocument);
>+            result->takeDOMWindowFrom(*oldDocument);
>             result->setSecurityOriginPolicy(oldDocument->securityOriginPolicy());
>             result->setCookieURL(oldDocument->cookieURL());
>             result->setFirstPartyForCookies(oldDocument->firstPartyForCookies());
>diff --git a/Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp b/Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp
>index 6c99e33fd116312c47d10b22a621fb71b629dfb0..290a1959ff314932c8b91bbcf77fbf07846559ec 100644
>--- a/Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp
>+++ b/Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp
>@@ -150,7 +150,7 @@ void WebFullScreenManager::willEnterFullScreen()
> {
>     LOG(Fullscreen, "WebFullScreenManager %p willEnterFullScreen() - element %p", this, m_element.get());
> 
>-    m_element->document().webkitWillEnterFullScreenForElement(m_element.get());
>+    m_element->document().webkitWillEnterFullScreen(*m_element);
> #if !PLATFORM(IOS_FAMILY)
>     m_page->hidePageBanners();
> #endif
>@@ -164,7 +164,7 @@ void WebFullScreenManager::didEnterFullScreen()
> {
>     LOG(Fullscreen, "WebFullScreenManager %p didEnterFullScreen() - element %p", this, m_element.get());
> 
>-    m_element->document().webkitDidEnterFullScreenForElement(m_element.get());
>+    m_element->document().webkitDidEnterFullScreen();
> 
> #if PLATFORM(IOS_FAMILY) || (PLATFORM(MAC) && ENABLE(VIDEO_PRESENTATION_MODE))
>     auto* currentPlaybackControlsElement = m_page->playbackSessionManager().currentPlaybackControlsElement();
>@@ -182,7 +182,7 @@ void WebFullScreenManager::willExitFullScreen()
> #endif
> 
>     m_finalFrame = screenRectOfContents(m_element.get());
>-    m_element->document().webkitWillExitFullScreenForElement(m_element.get());
>+    m_element->document().webkitWillExitFullScreen();
> #if !PLATFORM(IOS_FAMILY)
>     m_page->showPageBanners();
> #endif
>@@ -196,7 +196,7 @@ void WebFullScreenManager::didExitFullScreen()
>     ASSERT(m_element);
>     setFullscreenInsets(FloatBoxExtent());
>     setFullscreenAutoHideDuration(0_s);
>-    m_element->document().webkitDidExitFullScreenForElement(m_element.get());
>+    m_element->document().webkitDidExitFullScreen();
> }
> 
> void WebFullScreenManager::setAnimatingFullScreen(bool animating)
>diff --git a/Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp b/Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp
>index ad21dd2fe26eb23c869d05b81fed33491bf6fc8b..5623cc03140ab66a9f6cf5563970be527653faf0 100644
>--- a/Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp
>+++ b/Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp
>@@ -79,7 +79,7 @@ void UserMediaPermissionRequestManager::startUserMediaRequest(UserMediaRequest&
> 
>     auto& pendingRequests = m_blockedUserMediaRequests.add(document, Vector<RefPtr<UserMediaRequest>>()).iterator->value;
>     if (pendingRequests.isEmpty())
>-        document->addMediaCanStartListener(this);
>+        document->addMediaCanStartListener(*this);
>     pendingRequests.append(&request);
> }
> 
>@@ -119,7 +119,7 @@ void UserMediaPermissionRequestManager::mediaCanStart(Document& document)
>     while (!pendingRequests.isEmpty()) {
>         if (!document.page()->canStartMedia()) {
>             m_blockedUserMediaRequests.add(&document, pendingRequests);
>-            document.addMediaCanStartListener(this);
>+            document.addMediaCanStartListener(*this);
>             break;
>         }
> 
>@@ -139,7 +139,7 @@ void UserMediaPermissionRequestManager::removeMediaRequestFromMaps(UserMediaRequ
>             continue;
> 
>         if (pendingRequests.isEmpty())
>-            request.document()->removeMediaCanStartListener(this);
>+            request.document()->removeMediaCanStartListener(*this);
>         else
>             m_blockedUserMediaRequests.add(document, pendingRequests);
>         break;
>diff --git a/Source/WebKit/WebProcess/Plugins/PluginView.cpp b/Source/WebKit/WebProcess/Plugins/PluginView.cpp
>index 678548cf747c11512d48047b57d39019c95b7d70..173fd892e68a94e8369ee68db96c15e95a7d8c66 100644
>--- a/Source/WebKit/WebProcess/Plugins/PluginView.cpp
>+++ b/Source/WebKit/WebProcess/Plugins/PluginView.cpp
>@@ -321,9 +321,9 @@ PluginView::~PluginView()
>     ASSERT(!m_plugin || !m_plugin->isBeingDestroyed());
> 
>     if (m_isWaitingUntilMediaCanStart)
>-        m_pluginElement->document().removeMediaCanStartListener(this);
>+        m_pluginElement->document().removeMediaCanStartListener(*this);
> 
>-    m_pluginElement->document().removeAudioProducer(this);
>+    m_pluginElement->document().removeAudioProducer(*this);
> 
>     destroyPluginAndReset();
> 
>@@ -591,13 +591,13 @@ void PluginView::initializePlugin()
>                     return;
>                 
>                 m_isWaitingUntilMediaCanStart = true;
>-                m_pluginElement->document().addMediaCanStartListener(this);
>+                m_pluginElement->document().addMediaCanStartListener(*this);
>                 return;
>             }
>         }
>     }
> 
>-    m_pluginElement->document().addAudioProducer(this);
>+    m_pluginElement->document().addAudioProducer(*this);
> 
> #if ENABLE(PRIMARY_SNAPSHOTTED_PLUGIN_HEURISTIC)
>     HTMLPlugInImageElement& plugInImageElement = downcast<HTMLPlugInImageElement>(*m_pluginElement);
>diff --git a/Source/WebKitLegacy/mac/WebCoreSupport/WebKitFullScreenListener.mm b/Source/WebKitLegacy/mac/WebCoreSupport/WebKitFullScreenListener.mm
>index af5ac2f289bc1b120466c59c027906ec148165e7..537cc66805d49be0ed0fb41f6090635e6b995afa 100644
>--- a/Source/WebKitLegacy/mac/WebCoreSupport/WebKitFullScreenListener.mm
>+++ b/Source/WebKitLegacy/mac/WebCoreSupport/WebKitFullScreenListener.mm
>@@ -45,25 +45,25 @@ - (id)initWithElement:(Element*)element
> - (void)webkitWillEnterFullScreen
> {
>     if (_element)
>-        _element->document().webkitWillEnterFullScreenForElement(_element.get());
>+        _element->document().webkitWillEnterFullScreen(*_element);
> }
> 
> - (void)webkitDidEnterFullScreen
> {
>     if (_element)
>-        _element->document().webkitDidEnterFullScreenForElement(_element.get());
>+        _element->document().webkitDidEnterFullScreen();
> }
> 
> - (void)webkitWillExitFullScreen
> {
>     if (_element)
>-        _element->document().webkitWillExitFullScreenForElement(_element.get());
>+        _element->document().webkitWillExitFullScreen();
> }
> 
> - (void)webkitDidExitFullScreen
> {
>     if (_element)
>-        _element->document().webkitDidExitFullScreenForElement(_element.get());
>+        _element->document().webkitDidExitFullScreen();
> }
> 
> @end
>diff --git a/Source/WebKitLegacy/mac/WebView/WebFullScreenController.mm b/Source/WebKitLegacy/mac/WebView/WebFullScreenController.mm
>index d4dac542e4c698c50cdea44960daafd6b69c93ad..89bfa70c191bf19b68ca336a3e24d15184104e49 100644
>--- a/Source/WebKitLegacy/mac/WebView/WebFullScreenController.mm
>+++ b/Source/WebKitLegacy/mac/WebView/WebFullScreenController.mm
>@@ -237,7 +237,7 @@ - (void)enterFullScreen:(NSScreen *)screen
> 
>     _savedScale = [_webView _viewScaleFactor];
>     [_webView _scaleWebView:1 atOrigin:NSMakePoint(0, 0)];
>-    [self _document]->webkitWillEnterFullScreenForElement(_element.get());
>+    [self _document]->webkitWillEnterFullScreen(*_element);
>     [self _document]->setAnimatingFullScreen(true);
>     [self _document]->updateLayout();
> 
>@@ -272,7 +272,7 @@ - (void)finishedEnterFullScreenAnimation:(bool)completed
>         NSDisableScreenUpdates();
>         ALLOW_DEPRECATED_DECLARATIONS_END
>         [self _document]->setAnimatingFullScreen(false);
>-        [self _document]->webkitDidEnterFullScreenForElement(_element.get());
>+        [self _document]->webkitDidEnterFullScreen();
>         
>         NSRect windowBounds = [[self window] frame];
>         windowBounds.origin = NSZeroPoint;
>@@ -320,7 +320,7 @@ - (void)exitFullScreen
> 
>     _finalFrame = screenRectOfContents(_element.get());
> 
>-    [self _document]->webkitWillExitFullScreenForElement(_element.get());
>+    [self _document]->webkitWillExitFullScreen();
>     [self _document]->setAnimatingFullScreen(true);
> 
>     if (_isEnteringFullScreen)
>@@ -362,7 +362,7 @@ - (void)finishedExitFullScreenAnimation:(bool)completed
>     ALLOW_DEPRECATED_DECLARATIONS_END
> 
>     [self _document]->setAnimatingFullScreen(false);
>-    [self _document]->webkitDidExitFullScreenForElement(_element.get());
>+    [self _document]->webkitDidExitFullScreen();
>     [_webView _scaleWebView:_savedScale atOrigin:NSMakePoint(0, 0)];
> 
>     NSResponder *firstResponder = [[self window] firstResponder];
>diff --git a/Source/WebKitLegacy/mac/WebView/WebView.mm b/Source/WebKitLegacy/mac/WebView/WebView.mm
>index 9dde7dde1a7ad7fd6f218254f0b17d32ebf7bb3a..2de03ac36cc5ce455d757ed763088a56a8d4f902 100644
>--- a/Source/WebKitLegacy/mac/WebView/WebView.mm
>+++ b/Source/WebKitLegacy/mac/WebView/WebView.mm
>@@ -1482,10 +1482,8 @@ - (void)_commonInitializationWithFrameName:(NSString *)frameName groupName:(NSSt
> #if ENABLE(NOTIFICATIONS)
>     WebCore::provideNotification(_private->page, new WebNotificationClient(self));
> #endif
>-#if ENABLE(DEVICE_ORIENTATION)
>-#if !PLATFORM(IOS_FAMILY)
>-    WebCore::provideDeviceOrientationTo(_private->page, new WebDeviceOrientationClient(self));
>-#endif
>+#if ENABLE(DEVICE_ORIENTATION) && !PLATFORM(IOS_FAMILY)
>+    WebCore::provideDeviceOrientationTo(*_private->page, *new WebDeviceOrientationClient(self));
> #endif
> 
> #if ENABLE(REMOTE_INSPECTOR)
>diff --git a/Source/WebKitLegacy/win/Plugins/PluginView.cpp b/Source/WebKitLegacy/win/Plugins/PluginView.cpp
>index a391f96706fdff50fd336831b0df900087333d15..3b21cf1d08a253420e7ed014a28435bb61f6e331 100644
>--- a/Source/WebKitLegacy/win/Plugins/PluginView.cpp
>+++ b/Source/WebKitLegacy/win/Plugins/PluginView.cpp
>@@ -211,7 +211,7 @@ bool PluginView::startOrAddToUnstartedList()
>     // ourselves. Otherwise, the loader will try to deliver data before we've
>     // started the plug-in.
>     if (!m_loadManually && !m_parentFrame->page()->canStartMedia()) {
>-        m_parentFrame->document()->addMediaCanStartListener(this);
>+        m_parentFrame->document()->addMediaCanStartListener(*this);
>         m_isWaitingToStart = true;
>         return true;
>     }
>@@ -287,7 +287,7 @@ PluginView::~PluginView()
>         instanceMap().remove(m_instance);
> 
>     if (m_isWaitingToStart)
>-        m_parentFrame->document()->removeMediaCanStartListener(this);
>+        m_parentFrame->document()->removeMediaCanStartListener(*this);
> 
>     stop();
> 
>diff --git a/Source/WebKitLegacy/win/WebView.cpp b/Source/WebKitLegacy/win/WebView.cpp
>index feb2df3dd47609e1b3f6409ecd260d28d228dba8..e761744e0d1b85affd10b777cdd3791a4f71b31e 100644
>--- a/Source/WebKitLegacy/win/WebView.cpp
>+++ b/Source/WebKitLegacy/win/WebView.cpp
>@@ -7564,13 +7564,13 @@ void WebView::fullScreenClientSetParentWindow(HWND hostWindow)
> void WebView::fullScreenClientWillEnterFullScreen()
> {
>     ASSERT(m_fullScreenElement);
>-    m_fullScreenElement->document().webkitWillEnterFullScreenForElement(m_fullScreenElement.get());
>+    m_fullScreenElement->document().webkitWillEnterFullScreen(*m_fullScreenElement);
> }
> 
> void WebView::fullScreenClientDidEnterFullScreen()
> {
>     ASSERT(m_fullScreenElement);
>-    m_fullScreenElement->document().webkitDidEnterFullScreenForElement(m_fullScreenElement.get());
>+    m_fullScreenElement->document().webkitDidEnterFullScreen();
> }
> 
> void WebView::fullScreenClientWillExitFullScreen()
>@@ -7582,7 +7582,7 @@ void WebView::fullScreenClientWillExitFullScreen()
> void WebView::fullScreenClientDidExitFullScreen()
> {
>     ASSERT(m_fullScreenElement);
>-    m_fullScreenElement->document().webkitDidExitFullScreenForElement(m_fullScreenElement.get());
>+    m_fullScreenElement->document().webkitDidExitFullScreen();
>     m_fullScreenElement = nullptr;
> }
>

Flags:

dbates: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 175028: 316861 | 319727 | 319838 | 319840 | 319841 | 319843 | 319854 | 320401 | 359623