[oilpan] Completely move HTMLFormControlElement's hierarchy to the managed heap

Source/core/html/NumberInputType.h

Index: Source/core/html/NumberInputType.h
diff --git a/Source/core/html/NumberInputType.h b/Source/core/html/NumberInputType.h
index e5ed8e54bcd34641f0f7606ada96d31e722756f4..0b1e262c7a4356a67f7b831b152287e9512d9d25 100644
--- a/Source/core/html/NumberInputType.h
+++ b/Source/core/html/NumberInputType.h
@@ -37,10 +37,10 @@ namespace WebCore {
 
 class NumberInputType : public TextFieldInputType {
 public:
-    static PassOwnPtr<InputType> create(HTMLInputElement*);
+    static PassOwnPtr<InputType> create(Handle<HTMLInputElement>);
 
 private:
-    NumberInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    NumberInputType(Handle<HTMLInputElement> element) : TextFieldInputType(element) { }
     virtual void attach() OVERRIDE;
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;