Move the Widget hierarchy to the Oilpan heap.

Source/core/rendering/RenderScrollbar.h

 /*
  * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 26 matching lines @@
 class RenderBox;
 class RenderScrollbarPart;
 class RenderStyle;
 
 class RenderScrollbar FINAL : public Scrollbar {
 protected:
     RenderScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame*);
 
 public:
     friend class Scrollbar;
-    static PassRefPtr<Scrollbar> createCustomScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame* owningFrame = 0);
+    static PassRefPtrWillBeRawPtr<Scrollbar> createCustomScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame* owningFrame = 0);
     virtual ~RenderScrollbar();
 
     RenderBox* owningRenderer() const;
 
     IntRect buttonRect(ScrollbarPart);
     IntRect trackRect(int startLength, int endLength);
     IntRect trackPieceRectWithMargins(ScrollbarPart, const IntRect&);
 
     int minimumThumbLength();
 
     virtual bool isOverlayScrollbar() const OVERRIDE { return false; }
 
     RenderScrollbarPart* getPart(ScrollbarPart partType) { return m_parts.get(partType); }
 
+    virtual void trace(Visitor*) OVERRIDE;
+
 private:
     virtual void setParent(Widget*) OVERRIDE;
     virtual void setEnabled(bool) OVERRIDE;
 
     virtual void setHoveredPart(ScrollbarPart) OVERRIDE;
     virtual void setPressedPart(ScrollbarPart) OVERRIDE;
 
     virtual void styleChanged() OVERRIDE;
 
     virtual bool isCustomScrollbar() const OVERRIDE { return true; }
 
     void updateScrollbarParts(bool destroy = false);
 
     PassRefPtr<RenderStyle> getScrollbarPseudoStyle(ScrollbarPart, PseudoId);
     void updateScrollbarPart(ScrollbarPart, bool destroy = false);
 
     // This Scrollbar(Widget) may outlive the DOM which created it (during tear down),
     // so we keep a reference to the Node which caused this custom scrollbar creation.
     // This will not create a reference cycle as the Widget tree is owned by our containing
     // FrameView which this Node pointer can in no way keep alive. See webkit bug 80610.
-    RefPtrWillBePersistent<Node> m_owner;
+    RefPtrWillBeMember<Node> m_owner;
 
-    LocalFrame* m_owningFrame;
+    RawPtrWillBeMember<LocalFrame> m_owningFrame;
+
+    // FIXME: Oilpan: post-detach creation of RenderScrollbarPart
+    // objects (see ~RenderScrollbar comment) makes it difficult to
+    // ensure that all RenderScrollbarParts have been explicitly
+    // destroyed prior to finalization. To reliably address, a
+    // Persistent reference to the hash map is kept here, so that the
+    // RenderScrollbar finalizer can safely notify the 'parts' of
+    // destruction..before they're swept out the next time around.
+    GC_PLUGIN_IGNORE("")
     WillBePersistentHeapHashMap<unsigned, RawPtrWillBeMember<RenderScrollbarPart> > m_parts;
 };
 
 DEFINE_TYPE_CASTS(RenderScrollbar, ScrollbarThemeClient, scrollbar, scrollbar->isCustomScrollbar(), scrollbar.isCustomScrollbar());
 
 } // namespace blink
 
 #endif // RenderScrollbar_h