[oilpan] Completely move HTMLFormControlElement's hierarchy to the managed heap

Source/core/html/InputType.h

Index: Source/core/html/InputType.h
diff --git a/Source/core/html/InputType.h b/Source/core/html/InputType.h
index 0d35e1b09834bad2cdb5b32d01cf4f24c8b4a8cd..1b95d3ee8f77a71ae83b385cbdff4b50ab6deb9c 100644
--- a/Source/core/html/InputType.h
+++ b/Source/core/html/InputType.h
@@ -67,12 +67,11 @@ class TouchEvent;
 typedef int ExceptionCode;
 
 struct ClickHandlingState {
-    WTF_MAKE_FAST_ALLOCATED;
-  
 public:
     bool checked;
     bool indeterminate;
-    RefPtr<HTMLInputElement> checkedRadioButton;
+    // FIXME(oilpan): Move ClickHandlingState to the heap and use a Member for this.
+    Persistent<HTMLInputElement> checkedRadioButton;
 };
 
 // An InputType object represents the type-specific part of an HTMLInputElement.
@@ -83,8 +82,8 @@ class InputType {
     WTF_MAKE_FAST_ALLOCATED;
 
 public:
-    static PassOwnPtr<InputType> create(HTMLInputElement*, const AtomicString&);
-    static PassOwnPtr<InputType> createText(HTMLInputElement*);
+    static PassOwnPtr<InputType> create(Handle<HTMLInputElement>, const AtomicString&);
+    static PassOwnPtr<InputType> createText(Handle<HTMLInputElement>);
     virtual ~InputType();
 
     static bool themeSupportsDataListUI(InputType*);
@@ -307,8 +306,8 @@ public:
     void dispatchSimulatedClickIfActive(KeyboardEvent*) const;
 
 protected:
-    InputType(HTMLInputElement* element) : m_element(element) { }
-    HTMLInputElement* element() const { return m_element; }
+    InputType(const Handle<HTMLInputElement>&);
+    Result<HTMLInputElement> element() const;
     Chrome* chrome() const;
     Decimal parseToNumberOrNaN(const String&) const;
     void observeFeatureIfVisible(UseCounter::Feature) const;
@@ -317,7 +316,7 @@ private:
     // Helper for stepUp()/stepDown(). Adds step value * count to the current value.
     void applyStep(int count, AnyStepHandling, TextFieldEventBehavior, ExceptionCode&);
 
-    // Raw pointer because the HTMLInputElement object owns this InputType object.
+    // FIXME(oilpan): Raw pointer because the HTMLInputElement object owns this InputType object.
     HTMLInputElement* m_element;
 };