Oilpan: move DOM string collection objects to the Oilpan heap.

Source/core/html/HTMLOutputElement.h

 /*
  * Copyright (c) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 33 matching lines @@
 
     String value() const;
     void setValue(const String&);
     String defaultValue() const;
     void setDefaultValue(const String&);
     void setFor(const AtomicString&);
     DOMSettableTokenList* htmlFor() const;
 
     virtual bool canContainRangeEndPoint() const OVERRIDE { return false; }
 
+    virtual void trace(Visitor*) OVERRIDE;
+
 private:
     HTMLOutputElement(Document&, HTMLFormElement*);
 
     virtual void parseAttribute(const QualifiedName&, const AtomicString&) OVERRIDE;
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual bool isEnumeratable() const OVERRIDE { return true; }
     virtual bool supportLabels() const OVERRIDE { return true; }
     virtual bool supportsFocus() const OVERRIDE;
     virtual void childrenChanged(bool createdByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0) OVERRIDE;
     virtual void resetImpl() OVERRIDE;
 
     bool m_isDefaultValueMode;
     String m_defaultValue;
-    RefPtr<DOMSettableTokenList> m_tokens;
+    RefPtrWillBeMember<DOMSettableTokenList> m_tokens;
 };
 
 } // namespace
 
 #endif