Move the Widget hierarchy to the Oilpan heap.

Source/core/page/DragController.cpp

 /*
  * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Google Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 198 matching lines @@
 DragSession DragController::dragEntered(DragData* dragData)
 {
     return dragEnteredOrUpdated(dragData);
 }
 
 void DragController::dragExited(DragData* dragData)
 {
     ASSERT(dragData);
     LocalFrame* mainFrame = m_page->deprecatedLocalMainFrame();
 
-    if (RefPtr<FrameView> v = mainFrame->view()) {
+    if (RefPtrWillBeRawPtr<FrameView> v ALLOW_UNUSED = mainFrame->view()) {

[haraken, 2014/09/29 14:16:36]

How about writing like this?

RefPtrWillBeRawPtr<FrameView> frameView(mainFrame->view());
if (frameView) {
  ...;
}

Will it still cause a compilation issue?

[sof, 2014/10/02 14:03:54]

Sure, that will work - I just didn't want to accidentally extend the scope of
this protection here & break something for not much gain. But I've now verified
that this not an issue.

         DataTransferAccessPolicy policy = (!m_documentUnderMouse || m_documentUnderMouse->securityOrigin()->isLocal()) ? DataTransferReadable : DataTransferTypesReadable;
         RefPtrWillBeRawPtr<DataTransfer> dataTransfer = createDraggingDataTransfer(policy, dragData);
         dataTransfer->setSourceOperation(dragData->draggingSourceOperationMask());
         mainFrame->eventHandler().cancelDragAndDrop(createMouseEvent(dragData), dataTransfer.get());
         dataTransfer->setAccessPolicy(DataTransferNumb); // invalidate clipboard here for security
     }
     mouseMovedIntoDocument(0);
     if (m_fileInputElementUnderMouse)
         m_fileInputElementUnderMouse->setCanReceiveDroppedFiles(false);
     m_fileInputElementUnderMouse = nullptr;
@@ skipping 116 matching lines @@
         // tryDHTMLDrag fires dragenter event. The event listener that listens
         // to this event may create a nested message loop (open a modal dialog),
         // which could process dragleave event and reset m_documentUnderMouse in
         // dragExited.
         if (!m_documentUnderMouse)
             return false;
     }
 
     // It's unclear why this check is after tryDHTMLDrag.
     // We send drag events in tryDHTMLDrag and that may be the reason.
-    RefPtr<FrameView> frameView = m_documentUnderMouse->view();
+    RefPtrWillBeRawPtr<FrameView> frameView = m_documentUnderMouse->view();
     if (!frameView)
         return false;
 
     if (isHandlingDrag) {
         m_page->dragCaretController().clear();
         return true;
     }
 
     if ((actionMask & DragDestinationActionEdit) && canProcessDrag(dragData)) {
         IntPoint point = frameView->windowToContents(dragData->clientPosition());
@@ skipping 220 matching lines @@
 }
 
 bool DragController::tryDHTMLDrag(DragData* dragData, DragOperation& operation)
 {
     ASSERT(dragData);
     ASSERT(m_documentUnderMouse);
     RefPtrWillBeRawPtr<LocalFrame> mainFrame = m_page->deprecatedLocalMainFrame();
     if (!mainFrame->view())
         return false;
 
-    RefPtr<FrameView> viewProtector(mainFrame->view());
+    RefPtrWillBeRawPtr<FrameView> viewProtector(mainFrame->view());
     DataTransferAccessPolicy policy = m_documentUnderMouse->securityOrigin()->isLocal() ? DataTransferReadable : DataTransferTypesReadable;
     RefPtrWillBeRawPtr<DataTransfer> dataTransfer = createDraggingDataTransfer(policy, dragData);
     DragOperation srcOpMask = dragData->draggingSourceOperationMask();
     dataTransfer->setSourceOperation(srcOpMask);
 
     PlatformMouseEvent event = createMouseEvent(dragData);
     if (!mainFrame->eventHandler().updateDragAndDrop(event, dataTransfer.get())) {
         dataTransfer->setAccessPolicy(DataTransferNumb); // invalidate clipboard here for security
         return false;
     }
@@ skipping 314 matching lines @@
 
     return true;
 }
 
 void DragController::doSystemDrag(DragImage* image, const IntPoint& dragLocation, const IntPoint& eventPos, DataTransfer* dataTransfer, LocalFrame* frame, bool forLink)
 {
     m_didInitiateDrag = true;
     m_dragInitiator = frame->document();
     // Protect this frame and view, as a load may occur mid drag and attempt to unload this frame
     RefPtrWillBeRawPtr<LocalFrame> mainFrame = m_page->deprecatedLocalMainFrame();
-    RefPtr<FrameView> mainFrameView = mainFrame->view();
+    RefPtrWillBeRawPtr<FrameView> mainFrameView = mainFrame->view();
 
     m_client->startDrag(image, mainFrameView->rootViewToContents(frame->view()->contentsToRootView(dragLocation)),
         mainFrameView->rootViewToContents(frame->view()->contentsToRootView(eventPos)), dataTransfer, frame, forLink);
     // DragClient::startDrag can cause our Page to dispear, deallocating |this|.
     if (!frame->page())
         return;
 
     cleanupAfterSystemDrag();
 }
 
@@ skipping 24 matching lines @@
 
 void DragController::trace(Visitor* visitor)
 {
     visitor->trace(m_page);
     visitor->trace(m_documentUnderMouse);
     visitor->trace(m_dragInitiator);
     visitor->trace(m_fileInputElementUnderMouse);
 }
 
 } // namespace blink