Move the Widget hierarchy to the Oilpan heap.

Source/core/frame/LocalFrame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 75 matching lines @@
     Frame* parent = frame->tree().parent();
     if (!parent || !parent->isLocalFrame())
         return 1;
     return toLocalFrame(parent)->textZoomFactor();
 }
 
 inline LocalFrame::LocalFrame(FrameLoaderClient* client, FrameHost* host, FrameOwner* owner)
     : Frame(client, host, owner)
     , m_loader(this)
     , m_navigationScheduler(this)
-    , m_script(adoptPtr(new ScriptController(this)))
+    , m_script(ScriptController::create(this))
     , m_editor(Editor::create(*this))
     , m_spellChecker(SpellChecker::create(*this))
     , m_selection(FrameSelection::create(this))
     , m_eventHandler(adoptPtrWillBeNoop(new EventHandler(this)))
     , m_console(FrameConsole::create(*this))
     , m_inputMethodController(InputMethodController::create(*this))
     , m_pageZoomFactor(parentPageZoomFactor(this))
     , m_textZoomFactor(parentTextZoomFactor(this))
     , m_inViewSourceMode(false)
 {
@@ skipping 31 matching lines @@
         (*it)->frameDestroyed();
 #endif
 }
 
 void LocalFrame::trace(Visitor* visitor)
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_destructionObservers);
     visitor->trace(m_loader);
     visitor->trace(m_navigationScheduler);
+    visitor->trace(m_view);
     visitor->trace(m_pagePopupOwner);
     visitor->trace(m_editor);
     visitor->trace(m_spellChecker);
     visitor->trace(m_selection);
     visitor->trace(m_eventHandler);
     visitor->trace(m_console);
     visitor->trace(m_inputMethodController);
     HeapSupplementable<LocalFrame>::trace(visitor);
 #endif
     Frame::trace(visitor);
@@ skipping 36 matching lines @@
 {
     // We detach the FrameView's custom scroll bars as early as
     // possible to prevent m_doc->detach() from messing with the view
     // such that its scroll bars won't be torn down.
     //
     // FIXME: We should revisit this.
     if (m_view)
         m_view->prepareForDetach();
 }
 
-void LocalFrame::setView(PassRefPtr<FrameView> view)
+void LocalFrame::setView(PassRefPtrWillBeRawPtr<FrameView> view)
 {
     detachView();
 
     // Prepare for destruction now, so any unload event handlers get run and the LocalDOMWindow is
     // notified. If we wait until the view is destroyed, then things won't be hooked up enough for
     // these calls to work.
     if (!view && document() && document()->isActive()) {
         // FIXME: We don't call willRemove here. Why is that OK?
         document()->prepareForDestruction();
     }
 
     eventHandler().clear();
 
+    if (m_view && !view)

[haraken, 2014/09/29 14:16:36]

What is the '&& !view' check for?

How about calling m_view->dispose() in FrameView::prepareForDetach() ?

[haraken, 2014/10/03 15:02:58]

Would you reply to this question?

[sof, 2014/10/07 11:03:36]

I've now tweaked the predicate.
That would make the disposal happen _slightly_ earlier -- before the document is
informed of pending destruction, which detaches its RenderView -- which
conflicts with what dispose() assumes:

 ASSERT(m_frame->view() != this || !m_frame->contentRenderer());

i.e., we're disposing something that's not referred to from the LocalFrame _or_
that frame is itself detached & being destructed.

I don't think verifying that condition adds enough value for Oilpan (cf the
assert flag we have for disposal now), but I kept it non-Oilpan by moving it
into the dtor.

IOW.. :-) it makes some sense to have prepareForDetach() also take care of
disposing, hence now done. wdyt?

+        m_view->dispose();
+
     m_view = view;
 
     if (m_view && isMainFrame()) {
         if (settings()->pinchVirtualViewportEnabled())
             m_host->pinchViewport().mainFrameDidChangeSize();
         else
             m_view->setVisibleContentScaleFactor(page()->pageScaleFactor());
     }
 }
 
@@ skipping 207 matching lines @@
     ASSERT(this);
     ASSERT(page());
 
     bool isLocalRoot = this->isLocalRoot();
 
     if (isLocalRoot && view())
         view()->setParentVisible(false);
 
     setView(nullptr);
 
-    RefPtr<FrameView> frameView;
+    RefPtrWillBeRawPtr<FrameView> frameView = nullptr;
     if (isLocalRoot) {
         frameView = FrameView::create(this, viewportSize);
 
         // The layout size is set by WebViewImpl to support @viewport
         frameView->setLayoutSizeFixedToFrameSize(false);
     } else
         frameView = FrameView::create(this);
 
     frameView->setScrollbarModes(horizontalScrollbarMode, verticalScrollbarMode, horizontalLock, verticalLock);
 
@@ skipping 279 matching lines @@
 
     return curFrame;
 }
 
 void LocalFrame::setPagePopupOwner(Element& owner)
 {
     m_pagePopupOwner = &owner;
 }
 
 } // namespace blink