Bug 1266882 - Ensure the return value of CreateBR is addrefed in CopyLastEditableChildStyles. r=masayuki

Failure to increment the refcount to this BR node causes fatal cycle
collector assertions, and could lead to all sorts of other crashes.
This is a regression from bug 1156062, part 5.

editor/libeditor/nsHTMLEditor.cpp

@@ -4755,7 +4755,8 @@ nsHTMLEditor::CopyLastEditableChildStyles(nsIDOMNode * aPreviousBlock, nsIDOMNod
     childElement = childElement->GetParentElement();
   }
   if (deepestStyle) {
-    *aOutBrNode = CreateBR(deepestStyle, 0);
+    RefPtr<Element> retVal = CreateBR(deepestStyle, 0);
+    retVal.forget(aOutBrNode);
     NS_ENSURE_STATE(*aOutBrNode);
   }
   return NS_OK;