Oilpan: move ClientRect and its list to the oilpan heap.

Source/core/dom/Range.h

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 125 matching lines @@
     void didInsertText(Node*, unsigned offset, unsigned length);
     void didRemoveText(Node*, unsigned offset, unsigned length);
     void didMergeTextNodes(const NodeWithIndex& oldNode, unsigned offset);
     void didSplitTextNode(Text& oldNode);
 
     // Expand range to a unit (word or sentence or block or document) boundary.
     // Please refer to https://bugs.webkit.org/show_bug.cgi?id=27632 comment #5
     // for details.
     void expand(const String&, ExceptionState&);
 
-    PassRefPtr<ClientRectList> getClientRects() const;
-    PassRefPtr<ClientRect> getBoundingClientRect() const;
+    PassRefPtrWillBeRawPtr<ClientRectList> getClientRects() const;
+    PassRefPtrWillBeRawPtr<ClientRect> getBoundingClientRect() const;
 
 #ifndef NDEBUG
     void formatForDebugger(char* buffer, unsigned length) const;
 #endif
 
     void trace(Visitor*);
 
 private:
     explicit Range(Document&);
     Range(Document&, Node* startContainer, int startOffset, Node* endContainer, int endOffset);
@@ skipping 23 matching lines @@
 bool areRangesEqual(const Range*, const Range*);
 
 } // namespace
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 void showTree(const WebCore::Range*);
 #endif
 
 #endif