Move the Widget hierarchy to the Oilpan heap.

Source/core/css/SelectorChecker.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 48 matching lines @@
     public:
         // Initial selector constructor
         SelectorCheckingContext(const CSSSelector& selector, Element* element, VisitedMatchType visitedMatchType)
             : selector(&selector)
             , element(element)
             , previousElement(nullptr)
             , scope(nullptr)
             , visitedMatchType(visitedMatchType)
             , pseudoId(NOPSEUDO)
             , elementStyle(0)
-            , scrollbar(0)
+            , scrollbar(nullptr)
             , scrollbarPart(NoPart)
             , isSubSelector(false)
             , hasScrollbarPseudo(false)
             , hasSelectionPseudo(false)
             , isUARule(false)
             , contextFlags(DefaultBehavior)
         {
         }
 
         const CSSSelector* selector;
         RawPtrWillBeMember<Element> element;
         RawPtrWillBeMember<Element> previousElement;
         RawPtrWillBeMember<const ContainerNode> scope;
         VisitedMatchType visitedMatchType;
         PseudoId pseudoId;
         RenderStyle* elementStyle;
-        RenderScrollbar* scrollbar;
+        RawPtrWillBeMember<RenderScrollbar> scrollbar;
         ScrollbarPart scrollbarPart;
         bool isSubSelector;
         bool hasScrollbarPseudo;
         bool hasSelectionPseudo;
         bool isUARule;
         ContextFlags contextFlags;
     };
 
     struct MatchResult {
         MatchResult()
@@ skipping 78 matching lines @@
 }
 
 inline bool SelectorChecker::isHostInItsShadowTree(const Element& element, const ContainerNode* scope)
 {
     return scope && scope->isInShadowTree() && scope->shadowHost() == element;
 }
 
 }
 
 #endif