Oilpan: move Range object to the oilpan heap.

Source/core/editing/markup.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009, 2010, 2011 Google Inc. All rights reserved.
  * Copyright (C) 2011 Igalia S.L.
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 695 matching lines @@
 
     // FIXME: It's not clear what this code is trying to do. It puts nodes as direct children of a
     // Document that are not normally allowed by using the parser machinery.
     taggedDocument->parserTakeAllChildrenFrom(*taggedFragment);
 
     RefPtr<Node> nodeBeforeContext;
     RefPtr<Node> nodeAfterContext;
     if (!findNodesSurroundingContext(taggedDocument.get(), nodeBeforeContext, nodeAfterContext))
         return nullptr;
 
-    RefPtr<Range> range = Range::create(*taggedDocument.get(),
+    RefPtrWillBeRawPtr<Range> range = Range::create(*taggedDocument.get(),
         positionAfterNode(nodeBeforeContext.get()).parentAnchoredEquivalent(),
         positionBeforeNode(nodeAfterContext.get()).parentAnchoredEquivalent());
 
     Node* commonAncestor = range->commonAncestorContainer(ASSERT_NO_EXCEPTION);
     Node* specialCommonAncestor = ancestorToRetainStructureAndAppearanceWithNoRenderer(commonAncestor);
 
     // When there's a special common ancestor outside of the fragment, we must include it as well to
     // preserve the structure and appearance of the fragment. For example, if the fragment contains
     // TD, we need to include the enclosing TABLE tag as well.
     RefPtr<DocumentFragment> fragment = DocumentFragment::create(document);
@@ skipping 338 matching lines @@
         return;
 
     RefPtr<Text> textNode = toText(node.get());
     RefPtr<Text> textNext = toText(next);
     textNode->appendData(textNext->data());
     if (textNext->parentNode()) // Might have been removed by mutation event.
         textNext->remove(exceptionState);
 }
 
 }