Move the Widget hierarchy to the Oilpan heap.

Source/core/plugins/PluginOcclusionSupport.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 146 matching lines @@
     Vector<const RenderObject*> pluginZstack;
     Vector<const RenderObject*> iframeZstack;
     getObjectStack(pluginNode, &pluginZstack);
 
     if (!parentWidget->isFrameView())
         return;
 
     FrameView* parentFrameView = toFrameView(parentWidget);
 
     // Occlusions by iframes.
-    const HashSet<RefPtr<Widget> >* children = parentFrameView->children();
-    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != children->end(); ++it) {
+    const WillBeHeapHashSet<RefPtrWillBeMember<Widget> >* children = parentFrameView->children();
+    for (WillBeHeapHashSet<RefPtrWillBeMember<Widget> >::const_iterator it = children->begin(); it != children->end(); ++it) {
         // We only care about FrameView's because iframes show up as FrameViews.
         if (!(*it)->isFrameView())
             continue;
 
-        const FrameView* frameView = toFrameView((*it).get());
+        const FrameView* frameView = toFrameView(it->get());
         // Check to make sure we can get both the element and the RenderObject
         // for this FrameView, if we can't just move on to the next object.
         // FIXME: Plugin occlusion by remote frames is probably broken.
         HTMLElement* element = frameView->frame().deprecatedLocalOwner();
         if (!element || !element->renderer())
             continue;
 
         RenderObject* iframeRenderer = element->renderer();
 
         if (isHTMLIFrameElement(*element) && intersectsRect(iframeRenderer, frameRect)) {
@@ skipping 10 matching lines @@
     // as being in the top layer.
     const Element* ancestor = topLayerAncestor(element);
     Document* document = parentFrameView->frame().document();
     const WillBeHeapVector<RefPtrWillBeMember<Element> >& elements = document->topLayerElements();
     size_t start = ancestor ? elements.find(ancestor) + 1 : 0;
     for (size_t i = start; i < elements.size(); ++i)
         addTreeToOcclusions(elements[i]->renderer(), frameRect, occlusions);
 }
 
 } // namespace blink