Oilpan: move editing objects to the heap.

Source/core/editing/ReplaceNodeWithSpanCommand.h

Index: Source/core/editing/ReplaceNodeWithSpanCommand.h
diff --git a/Source/core/editing/ReplaceNodeWithSpanCommand.h b/Source/core/editing/ReplaceNodeWithSpanCommand.h
index 76bbcc8e8b0bd0af16c9c465f296d0d27e3dee7f..6d1f13b132b520f48e504258e7a75ed795e31cb9 100644
--- a/Source/core/editing/ReplaceNodeWithSpanCommand.h
+++ b/Source/core/editing/ReplaceNodeWithSpanCommand.h
@@ -40,21 +40,23 @@ class HTMLElement;
 // More accurately, this is ReplaceElementWithSpanPreservingChildrenAndAttributesCommand
 class ReplaceNodeWithSpanCommand FINAL : public SimpleEditCommand {
 public:
-    static PassRefPtr<ReplaceNodeWithSpanCommand> create(PassRefPtrWillBeRawPtr<HTMLElement> element)
+    static PassRefPtrWillBeRawPtr<ReplaceNodeWithSpanCommand> create(PassRefPtrWillBeRawPtr<HTMLElement> element)
     {
-        return adoptRef(new ReplaceNodeWithSpanCommand(element));
+        return adoptRefWillBeNoop(new ReplaceNodeWithSpanCommand(element));
     }
 
     HTMLElement* spanElement() { return m_spanElement.get(); }
 
+    virtual void trace(Visitor*) OVERRIDE;
+
 private:
     explicit ReplaceNodeWithSpanCommand(PassRefPtrWillBeRawPtr<HTMLElement>);
 
     virtual void doApply() OVERRIDE;
     virtual void doUnapply() OVERRIDE;
 
-    RefPtrWillBePersistent<HTMLElement> m_elementToReplace;
-    RefPtrWillBePersistent<HTMLElement> m_spanElement;
+    RefPtrWillBeMember<HTMLElement> m_elementToReplace;
+    RefPtrWillBeMember<HTMLElement> m_spanElement;
 };
 
 } // namespace WebCore