Oilpan: use transition types for remaining RefPtr<Document>s in dom/.

Source/core/dom/Range.cpp

Index: Source/core/dom/Range.cpp
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp
index 9189f403bbb65bda280a75d7fa493fb648135f57..f46661d4765b82f1c4e28f013baefb39281116b6 100644
--- a/Source/core/dom/Range.cpp
+++ b/Source/core/dom/Range.cpp
@@ -1496,7 +1496,7 @@ static inline void boundaryNodeWillBeRemoved(RangeBoundaryPoint& boundary, Node&
 void Range::nodeWillBeRemoved(Node& node)
 {
     ASSERT(node.document() == m_ownerDocument);
-    ASSERT(node != m_ownerDocument);
+    ASSERT(node != m_ownerDocument.get());
 
     // FIXME: Once DOMNodeRemovedFromDocument mutation event removed, we
     // should change following if-statement to ASSERT(!node->parentNode).
@@ -1678,8 +1678,9 @@ FloatRect Range::boundingRect() const
     return result;
 }
 
-void Range::trace(Visitor*)
+void Range::trace(Visitor* visitor)
 {
+    visitor->trace(m_ownerDocument);
 }
 
 } // namespace WebCore