Oilpan: move LiveNodeList collections to the heap.

Source/core/dom/Node.h

Index: Source/core/dom/Node.h
diff --git a/Source/core/dom/Node.h b/Source/core/dom/Node.h
index 2cca7d931dcc1e44568233246d24eddb3433857a..87029c056c9ceb4903e8da45fd9eac8b90640f28 100644
--- a/Source/core/dom/Node.h
+++ b/Source/core/dom/Node.h
@@ -173,7 +173,7 @@ public:
     ContainerNode* parentElementOrDocumentFragment() const;
     Node* previousSibling() const { return m_previous; }
     Node* nextSibling() const { return m_next; }
-    PassRefPtr<NodeList> childNodes();
+    PassRefPtrWillBeRawPtr<NodeList> childNodes();
     Node* firstChild() const;
     Node* lastChild() const;
 
@@ -667,7 +667,7 @@ public:
     void updateAncestorConnectedSubframeCountForRemoval() const;
     void updateAncestorConnectedSubframeCountForInsertion() const;
 
-    PassRefPtr<NodeList> getDestinationInsertionPoints();
+    PassRefPtrWillBeRawPtr<NodeList> getDestinationInsertionPoints();
 
     void setAlreadySpellChecked(bool flag) { setFlag(flag, AlreadySpellCheckedFlag); }
     bool isAlreadySpellChecked() { return getFlag(AlreadySpellCheckedFlag); }