Move the Widget hierarchy to the Oilpan heap.

Source/bindings/core/v8/ScriptController.h

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 55 matching lines @@
     NotAboutToExecuteScript
 };
 
 class ScriptController {
 public:
     enum ExecuteScriptPolicy {
         ExecuteScriptWhenScriptsDisabled,
         DoNotExecuteScriptWhenScriptsDisabled
     };
 
-    ScriptController(LocalFrame*);
+    static PassOwnPtr<ScriptController> create(LocalFrame* frame)
+    {
+        return adoptPtr(new ScriptController(frame));
+    }
+
     ~ScriptController();
 
     bool initializeMainWorld();
     WindowProxy* windowProxy(DOMWrapperWorld&);
     WindowProxy* existingWindowProxy(DOMWrapperWorld&);
 
     // Evaluate JavaScript in the main world.
     void executeScriptInMainWorld(const String&, ExecuteScriptPolicy = DoNotExecuteScriptWhenScriptsDisabled);
     void executeScriptInMainWorld(const ScriptSourceCode&, AccessControlStatus = NotSharableCrossOrigin, double* compilationFinishTime = 0);
     v8::Local<v8::Value> executeScriptInMainWorldAndReturnValue(const ScriptSourceCode&);
@@ skipping 39 matching lines @@
 
     void clearWindowProxy();
     void updateDocument();
 
     void namedItemAdded(HTMLDocument*, const AtomicString&);
     void namedItemRemoved(HTMLDocument*, const AtomicString&);
 
     void updateSecurityOrigin(SecurityOrigin*);
     void clearScriptObjects();
     void cleanupScriptObjectsForPlugin(Widget*);
-
     void clearForClose();
 
     NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
     NPObject* windowScriptNPObject();
 
     // Registers a v8 extension to be available on webpages. Will only
     // affect v8 contexts initialized after this call. Takes ownership of
     // the v8::Extension object passed.
     static void registerExtensionIfNeeded(v8::Extension*);
     static V8Extensions& registeredExtensions();
 
     void setWorldDebugId(int worldId, int debuggerId);
 
     v8::Isolate* isolate() const { return m_isolate; }
 
 private:
+    explicit ScriptController(LocalFrame*);
+
     typedef HashMap<int, OwnPtr<WindowProxy> > IsolatedWorldMap;
     typedef HashMap<Widget*, NPObject*> PluginObjectMap;
 
     v8::Local<v8::Value> evaluateScriptInMainWorld(const ScriptSourceCode&, AccessControlStatus, ExecuteScriptPolicy, double* compilationFinishTime = 0);
 
     LocalFrame* m_frame;
     const String* m_sourceURL;
     v8::Isolate* m_isolate;
 
     OwnPtr<WindowProxy> m_windowProxy;
     IsolatedWorldMap m_isolatedWorlds;
 
     // A mapping between Widgets and their corresponding script object.
     // This list is used so that when the plugin dies, we can immediately
     // invalidate all sub-objects which are associated with that plugin.
     // The frame keeps a NPObject reference for each item on the list.
     PluginObjectMap m_pluginObjects;
 
     NPObject* m_windowScriptNPObject;
 };
 
 } // namespace blink
 
 #endif // ScriptController_h