Oilpan: use transition types for remaining RefPtr<Document>s in dom/.

Source/core/dom/Range.cpp

Index: Source/core/dom/Range.cpp
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp
index 9189f403bbb65bda280a75d7fa493fb648135f57..75b7fd88993465bc3f2977676ec2844ad8ec8c91 100644
--- a/Source/core/dom/Range.cpp
+++ b/Source/core/dom/Range.cpp
@@ -106,8 +106,10 @@ PassRefPtrWillBeRawPtr<Range> Range::create(Document& ownerDocument, const Posit
 
 Range::~Range()
 {
+#if !ENABLE(OILPAN)
     // Always detach (even if we've already detached) to fix https://bugs.webkit.org/show_bug.cgi?id=26044
     m_ownerDocument->detachRange(this);
+#endif
 
 #ifndef NDEBUG
     rangeCounter.decrement();
@@ -1496,7 +1498,7 @@ static inline void boundaryNodeWillBeRemoved(RangeBoundaryPoint& boundary, Node&
 void Range::nodeWillBeRemoved(Node& node)
 {
     ASSERT(node.document() == m_ownerDocument);
-    ASSERT(node != m_ownerDocument);
+    ASSERT(node != m_ownerDocument.get());
 
     // FIXME: Once DOMNodeRemovedFromDocument mutation event removed, we
     // should change following if-statement to ASSERT(!node->parentNode).
@@ -1678,8 +1680,9 @@ FloatRect Range::boundingRect() const
     return result;
 }
 
-void Range::trace(Visitor*)
+void Range::trace(Visitor* visitor)
 {
+    visitor->trace(m_ownerDocument);
 }
 
 } // namespace WebCore