[oilpan] Completely move HTMLFormControlElement's hierarchy to the managed heap

Source/core/html/HTMLKeygenElement.h

Index: Source/core/html/HTMLKeygenElement.h
diff --git a/Source/core/html/HTMLKeygenElement.h b/Source/core/html/HTMLKeygenElement.h
index 777afeeb845f3e60d625cd4199799d237e00fadf..436b0b0fc5920d831383e83021112fb693510ed3 100644
--- a/Source/core/html/HTMLKeygenElement.h
+++ b/Source/core/html/HTMLKeygenElement.h
@@ -32,10 +32,12 @@ class HTMLSelectElement;
 
 class HTMLKeygenElement : public HTMLFormControlElementWithState {
 public:
-    static PassRefPtr<HTMLKeygenElement> create(const QualifiedName&, Document*, HTMLFormElement*);
+    static Result<HTMLKeygenElement> create(const QualifiedName&, Document*, HTMLFormElement*);
 
     virtual bool willValidate() const { return false; }
 
+    virtual void acceptHeapVisitor(Visitor*) const OVERRIDE;
+
 private:
     HTMLKeygenElement(const QualifiedName&, Document*, HTMLFormElement*);
 
@@ -55,7 +57,7 @@ private:
     virtual void reset();
     virtual bool shouldSaveAndRestoreFormControlState() const OVERRIDE;
 
-    HTMLSelectElement* shadowSelect() const;
+    Result<HTMLSelectElement> shadowSelect() const;
 };
 
 } //namespace