Oilpan: have xml/ objects on the heap by default.

Source/bindings/core/v8/V8Binding.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 623 matching lines @@
         }
     }
 
     // USVString is identical to DOMString except that "convert a
     // DOMString to a sequence of Unicode characters" is used subsequently
     // when converting to an IDL value
     String x = toCoreString(stringObject);
     return replaceUnmatchedSurrogates(x);
 }
 
-PassRefPtrWillBeRawPtr<XPathNSResolver> toXPathNSResolver(ScriptState* scriptState, v8::Handle<v8::Value> value)
+XPathNSResolver* toXPathNSResolver(ScriptState* scriptState, v8::Handle<v8::Value> value)
 {
-    RefPtrWillBeRawPtr<XPathNSResolver> resolver = nullptr;
+    XPathNSResolver* resolver = nullptr;
     if (V8XPathNSResolver::hasInstance(value, scriptState->isolate()))
         resolver = V8XPathNSResolver::toImpl(v8::Handle<v8::Object>::Cast(value));
     else if (value->IsObject())
         resolver = V8CustomXPathNSResolver::create(scriptState, value.As<v8::Object>());
     return resolver;
 }
 
 DOMWindow* toDOMWindow(v8::Isolate* isolate, v8::Handle<v8::Value> value)
 {
     if (value.IsEmpty() || !value->IsObject())
@@ skipping 330 matching lines @@
     v8::Local<v8::Value> data = info.Data();
     ASSERT(data->IsExternal());
     V8PerContextData* perContextData = V8PerContextData::from(info.Holder()->CreationContext());
     if (!perContextData)
         return;
     v8SetReturnValue(info, perContextData->constructorForType(WrapperTypeInfo::unwrap(data)));
     TRACE_EVENT_SET_SAMPLING_STATE("v8", "V8Execution");
 }
 
 } // namespace blink