Oilpan: make DocumentFragment a heap allocated object.

Source/core/dom/Element.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 313 matching lines @@
     void didAffectSelector(AffectedSelectorMask);
     void setAnimationStyleChange(bool);
     void setNeedsAnimationStyleRecalc();
 
     void setNeedsCompositingUpdate();
 
     bool supportsStyleSharing() const;
 
     ElementShadow* shadow() const;
     ElementShadow& ensureShadow();
-    PassRefPtr<ShadowRoot> createShadowRoot(ExceptionState&);
+    PassRefPtrWillBeRawPtr<ShadowRoot> createShadowRoot(ExceptionState&);
     ShadowRoot* shadowRoot() const;
     ShadowRoot* youngestShadowRoot() const;
 
     bool hasAuthorShadowRoot() const { return shadowRoot(); }
     ShadowRoot* userAgentShadowRoot() const;
     ShadowRoot& ensureUserAgentShadowRoot();
     virtual void willAddFirstAuthorShadowRoot() { }
 
     bool isInDescendantTreeOf(const Element* shadowHost) const;
 
@@ skipping 534 matching lines @@
     template <> inline bool isElementOfType<const thisType>(const Element& element) { return element.predicate; } \
     DEFINE_NODE_TYPE_CASTS(thisType, predicate)
 
 #define DEFINE_ELEMENT_TYPE_CASTS_WITH_FUNCTION(thisType) \
     template <> inline bool isElementOfType<const thisType>(const Element& element) { return is##thisType(element); } \
     DEFINE_NODE_TYPE_CASTS_WITH_FUNCTION(thisType)
 
 } // namespace
 
 #endif