diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index bed495dc55f61f43e5ac51c383bab30de9a18459..6b4b6d14c205b3e7d03d567f8a9557f44506c391 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2007-04-26  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by oliver
+        
+        <rdar://problem/5120591> Crash when creating a link in Leopard wiki server
+
+        * editing/execCommand/5120591-expected.checksum: Added.
+        * editing/execCommand/5120591-expected.png: Added.
+        * editing/execCommand/5120591-expected.txt: Added.
+        * editing/execCommand/5120591.html: Added.
+
 2007-04-26  Matt Perry  <mpComplete@gmail.com>
 
         Reviewed, tweaked and landed by Alexey.
diff --git a/LayoutTests/editing/execCommand/5120591-expected.checksum b/LayoutTests/editing/execCommand/5120591-expected.checksum
new file mode 100644
index 0000000000000000000000000000000000000000..c217260324e224643fcd125af7b02bd8c4d65faa
--- /dev/null
+++ b/LayoutTests/editing/execCommand/5120591-expected.checksum
@@ -0,0 +1 @@
+6a3283980391f6371da9cd66cc2223b3
\ No newline at end of file
diff --git a/LayoutTests/editing/execCommand/5120591-expected.png b/LayoutTests/editing/execCommand/5120591-expected.png
new file mode 100644
index 0000000000000000000000000000000000000000..2507c7a701f1447522239d980361556161b64daf
Binary files /dev/null and b/LayoutTests/editing/execCommand/5120591-expected.png differ
diff --git a/LayoutTests/editing/execCommand/5120591-expected.txt b/LayoutTests/editing/execCommand/5120591-expected.txt
new file mode 100644
index 0000000000000000000000000000000000000000..b213c0fe7eb4afbd1d25126ee90103a3affbadaf
--- /dev/null
+++ b/LayoutTests/editing/execCommand/5120591-expected.txt
@@ -0,0 +1,14 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {P} at (0,0) size 784x18
+        RenderText {#text} at (0,0) size 574x18
+          text run at (0,0) width 574: "Tests for a crash when creating a link inside a region with a subtree modified event listener."
+      RenderBlock {DIV} at (0,34) size 784x18
+        RenderInline {A} at (0,0) size 136x18 [color=#0000EE]
+          RenderText {#text} at (0,0) size 136x18
+            text run at (0,0) width 136: "This should be a link."
+selection start: position 0 of child 0 {#text} of child 0 {A} of child 2 {DIV} of child 0 {BODY} of child 0 {HTML} of document
+selection end:   position 22 of child 0 {#text} of child 0 {A} of child 2 {DIV} of child 0 {BODY} of child 0 {HTML} of document
diff --git a/LayoutTests/editing/execCommand/5120591.html b/LayoutTests/editing/execCommand/5120591.html
new file mode 100644
index 0000000000000000000000000000000000000000..ce43869fd7103ec0fc6126a4525d0032d9b18724
--- /dev/null
+++ b/LayoutTests/editing/execCommand/5120591.html
@@ -0,0 +1,10 @@
+<p>Tests for a crash when creating a link inside a region with a subtree modified event listener.</p>
+<div contenteditable="true" id="div">This should be a link.</div>
+
+<script>
+var div = document.getElementById("div");
+div.addEventListener('DOMSubtreeModified', function () {;});
+div.focus();
+document.execCommand("SelectAll");
+document.execCommand("CreateLink", false, "#");
+</script>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 9cb6c1d84bea57292dc34a871910f18b90bee1b7..52e35fbe27240198a33d513beae95bd66b248266 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2007-04-26  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by oliver
+
+        <rdar://problem/5120591> 
+        Crash when creating a link in Leopard wiki server
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Use a RefPtr,
+        setting the anchor's href can destroy it if there is
+        an ancestor with a subtree modified event listener.
+
 2007-04-26  Mitz Pettel  <mitz@webkit.org>
 
         Reviewed by hyatt
diff --git a/WebCore/editing/CreateLinkCommand.cpp b/WebCore/editing/CreateLinkCommand.cpp
index 9a5651a5bb4651fd81c33d0e4438b060c27ac40a..2eef9d0bb9dbc8efaa4c62d7ade6d2b0fa96d518 100644
--- a/WebCore/editing/CreateLinkCommand.cpp
+++ b/WebCore/editing/CreateLinkCommand.cpp
@@ -43,9 +43,9 @@ void CreateLinkCommand::doApply()
         
     pushPartiallySelectedAnchorElementsDown();
 
-    HTMLAnchorElement* anchorElement = new HTMLAnchorElement(document());
+    RefPtr<HTMLAnchorElement> anchorElement = new HTMLAnchorElement(document());
     anchorElement->setHref(m_url);
-    applyStyledElement(anchorElement);
+    applyStyledElement(anchorElement.get());
 }
 
 }