Move the Widget hierarchy to the Oilpan heap.

Source/core/rendering/RenderLayerScrollableArea.h

 /*
  * Copyright (C) 2003, 2009, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 180 matching lines @@
     void computeScrollDimensions();
 
     IntSize clampScrollOffset(const IntSize&) const;
 
     IntRect rectForHorizontalScrollbar(const IntRect& borderBoxRect) const;
     IntRect rectForVerticalScrollbar(const IntRect& borderBoxRect) const;
     LayoutUnit verticalScrollbarStart(int minX, int maxX) const;
     LayoutUnit horizontalScrollbarStart(int minX) const;
     IntSize scrollbarOffset(const Scrollbar*) const;
 
-    PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
+    PassRefPtrWillBeRawPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
     void destroyScrollbar(ScrollbarOrientation);
 
     void setHasHorizontalScrollbar(bool hasScrollbar);
     void setHasVerticalScrollbar(bool hasScrollbar);
 
     void updateScrollCornerStyle();
 
     // See comments on isPointInResizeControl.
     IntRect resizerCornerRect(const IntRect&, ResizerHitTestType) const;
     bool overflowControlsIntersectRect(const IntRect& localRect) const;
@@ skipping 26 matching lines @@
 
     // The width/height of our scrolled area.
     LayoutRect m_overflowRect;
 
     // This is the (scroll) offset from scrollOrigin().
     IntSize m_scrollOffset;
 
     IntPoint m_cachedOverlayScrollbarOffset;
 
     // For areas with overflow, we have a pair of scrollbars.
-    RefPtr<Scrollbar> m_hBar;
-    RefPtr<Scrollbar> m_vBar;
+    RefPtrWillBePersistent<Scrollbar> m_hBar;
+    RefPtrWillBePersistent<Scrollbar> m_vBar;
 
     // Renderers to hold our custom scroll corner.
     RawPtrWillBePersistent<RenderScrollbarPart> m_scrollCorner;
 
     // Renderers to hold our custom resizer.
     RawPtrWillBePersistent<RenderScrollbarPart> m_resizer;
 };
 
 } // namespace blink
 
 #endif // RenderLayerScrollableArea_h