Move the Widget hierarchy to the Oilpan heap.

Source/core/accessibility/AXScrollView.h

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 57 matching lines @@
     virtual FrameView* documentFrameView() const override;
     virtual LayoutRect elementRect() const override;
     virtual AXObject* parentObject() const override;
     virtual AXObject* parentObjectIfExists() const override;
 
     AXObject* webAreaObject() const;
     virtual AXObject* firstChild() const override { return webAreaObject(); }
     AXScrollbar* addChildScrollbar(Scrollbar*);
     void removeChildScrollbar(AXObject*);
 
+    // FIXME: Oilpan: Frame/ScrollView is on the heap and its
+    // AXScrollView is detached&removed from the AX cache when the
+    // FrameView is disposed. Which clears m_scrollView, hence this
+    // bare pointer will not be stale, so the bare pointer use is safe
+    // & acceptable.
+    //
+    // However, it would be preferable to have it be normally traced
+    // as part of moving the AX objects to the heap. Temporarily using
+    // a Persistent risks creating a FrameView leak, and brings no
+    // real benefits overall.
     FrameView* m_scrollView;
     RefPtr<AXObject> m_horizontalScrollbar;
     RefPtr<AXObject> m_verticalScrollbar;
     bool m_childrenDirty;
 };
 
 DEFINE_AX_OBJECT_TYPE_CASTS(AXScrollView, isAXScrollView());
 
 } // namespace blink
 
 #endif // AXScrollView_h