Move the Widget hierarchy to the Oilpan heap.

Source/web/PopupMenuChromium.cpp

 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 29 matching lines @@
 namespace blink {
 
 PopupMenuChromium::PopupMenuChromium(LocalFrame& frame, PopupMenuClient* client)
     : m_popupClient(client)
     , m_frameView(frame.view())
 {
 }
 
 PopupMenuChromium::~PopupMenuChromium()
 {
+#if !ENABLE(OILPAN)

[haraken, 2014/09/29 14:16:37]

Can we add an assert to oilpan builds to verify that dispose() has been already
called?

[sof, 2014/10/02 14:03:54]

Done.

+    dispose();
+#endif
+}
+
+void PopupMenuChromium::dispose()
+{
     // When the PopupMenuChromium is destroyed, the client could already have been deleted.
     if (m_popup)
         m_popup->disconnectClient();
     hide();
 }
 
+void PopupMenuChromium::trace(Visitor* visitor)
+{
+    visitor->trace(m_frameView);
+    visitor->trace(m_popup);
+    PopupMenu::trace(visitor);
+}
+
 void PopupMenuChromium::show(const FloatQuad& controlPosition, const IntSize& controlSize, int index)
 {
     if (!m_popup) {
         bool deviceSupportsTouch = m_frameView->frame().settings()->deviceSupportsTouch();
         m_popup = PopupContainer::create(m_popupClient, deviceSupportsTouch);
     }
     m_popup->showInRect(controlPosition, controlSize, m_frameView.get(), index);
 }
 
 void PopupMenuChromium::hide()
 {
     if (m_popup)
         m_popup->hide();
 }
 
 void PopupMenuChromium::updateFromElement()
 {
     m_popup->updateFromElement();
 }
 
 
 void PopupMenuChromium::disconnectClient()
 {
     m_popupClient = 0;
+#if ENABLE(OILPAN)
+    // Cannot be done during finalization, so instead done when the
+    // render object is destroyed and disconnected.
+    dispose();

[haraken, 2014/09/29 14:16:37]

How about making non-oilpan builds call dispose() here as well?

(We don't want to have different behavior between oilpan builds and non-oilpan
builds as much as possible.)

[sof, 2014/10/02 14:03:54]

That's always preferable and I suspect that might work out in this case, but my
preference is to handle that separately to reduce risk. Added a FIXME.

+#endif
 }
 
 } // namespace blink