[oilpan] Completely move HTMLFormControlElement's hierarchy to the managed heap

Source/core/rendering/RenderListBox.h

 /*
  * This file is part of the select element renderer in WebCore.
  *
  * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
@@ skipping 40 matching lines @@
     LayoutRect itemBoundingBoxRect(const LayoutPoint&, int index);
 
     bool scrollToRevealElementAtListIndex(int index);
     bool listIndexIsVisible(int index);
 
     int scrollToward(const IntPoint&); // Returns the new index or -1 if no scroll occurred
 
     int size() const;
 
 private:
-    HTMLSelectElement* selectElement() const;
+    Result<HTMLSelectElement> selectElement() const;
 
     virtual const char* renderName() const { return "RenderListBox"; }
 
     virtual bool isListBox() const { return true; }
 
     virtual void updateFromElement();
     virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
     virtual bool hasControlClip() const { return true; }
     virtual void paintObject(PaintInfo&, const LayoutPoint&);
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
@@ skipping 84 matching lines @@
     ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isListBox());
     return static_cast<RenderListBox*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
 void toRenderListBox(const RenderListBox*);
 
 } // namepace WebCore
 
 #endif // RenderListBox_h