Oilpan: move Range object to the oilpan heap.

Source/core/editing/FrameSelection.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 336 matching lines @@
         clearRenderTreeSelection = true;
     } else if (baseRemoved || extentRemoved) {
         // The base and/or extent are about to be removed, but the start and end aren't.
         // Change the base and extent to the start and end, but don't re-validate the
         // selection, since doing so could move the start and end into the node
         // that is about to be removed.
         if (m_selection.isBaseFirst())
             m_selection.setWithoutValidation(m_selection.start(), m_selection.end());
         else
             m_selection.setWithoutValidation(m_selection.end(), m_selection.start());
-    } else if (RefPtr<Range> range = m_selection.firstRange()) {
+    } else if (RefPtrWillBeRawPtr<Range> range = m_selection.firstRange()) {
         TrackExceptionState exceptionState;
         Range::CompareResults compareResult = range->compareNode(&node, exceptionState);
         if (!exceptionState.hadException() && (compareResult == Range::NODE_BEFORE_AND_AFTER || compareResult == Range::NODE_INSIDE)) {
             // If we did nothing here, when this node's renderer was destroyed, the rect that it
             // occupied would be invalidated, but, selection gaps that change as a result of
             // the removal wouldn't be invalidated.
             // FIXME: Don't do so much unnecessary invalidation.
             clearRenderTreeSelection = true;
         }
     }
@@ skipping 1053 matching lines @@
     VisiblePosition visibleStart(range->startPosition(), collapsed ? affinity : DOWNSTREAM);
     VisiblePosition visibleEnd(range->endPosition(), SEL_DEFAULT_AFFINITY);
     setSelection(VisibleSelection(visibleStart, visibleEnd), options);
 
     m_logicalRange = range->cloneRange(ASSERT_NO_EXCEPTION);
     startObservingVisibleSelectionChange();
 
     return true;
 }
 
-PassRefPtr<Range> FrameSelection::firstRange() const
+PassRefPtrWillBeRawPtr<Range> FrameSelection::firstRange() const
 {
     if (m_logicalRange)
         return m_logicalRange->cloneRange(ASSERT_NO_EXCEPTION);
     return m_selection.firstRange();
 }
 
 bool FrameSelection::isInPasswordField() const
 {
     HTMLTextFormControlElement* textControl = enclosingTextFormControl(start());
     return isHTMLInputElement(textControl) && toHTMLInputElement(textControl)->isPasswordField();
@@ skipping 434 matching lines @@
     sel.showTreeForThis();
 }
 
 void showTree(const WebCore::FrameSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
 }
 
 #endif