Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLPlugInElement.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2008, 2009, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 27 matching lines @@
 
 enum PreferPlugInsForImagesOption {
     ShouldPreferPlugInsForImages,
     ShouldNotPreferPlugInsForImages
 };
 
 class HTMLPlugInElement : public HTMLFrameOwnerElement {
 public:
     virtual ~HTMLPlugInElement();
     virtual void trace(Visitor*) OVERRIDE;
+#if ENABLE(OILPAN)
+    virtual void disconnectContentFrame() OVERRIDE;
+#endif
 
     void resetInstance();
     SharedPersistent<v8::Object>* pluginWrapper();
     Widget* pluginWidget() const;
     NPObject* getNPObject();
     bool canProcessDrag() const;
     const String& url() const { return m_url; }
 
     // Public for FrameView::addWidgetToUpdate()
     bool needsWidgetUpdate() const { return m_needsWidgetUpdate; }
@@ skipping 78 matching lines @@
     bool m_isCapturingMouseEvents;
     bool m_needsWidgetUpdate;
     bool m_shouldPreferPlugInsForImages;
     bool m_usePlaceholderContent;
 
     // Normally the Widget is stored in HTMLFrameOwnerElement::m_widget.
     // However, plugins can persist even when not rendered. In order to
     // prevent confusing code which may assume that widget() != null
     // means the frame is active, we save off m_widget here while
     // the plugin is persisting but not being displayed.
-    RefPtr<Widget> m_persistedPluginWidget;
+    // ---
+    // Oilpan: a Persistent<> is used for finalization purposes.
+    // A renderer-less plugin element is not detached prior to
+    // finalization, so the required disposing of plugin container
+    // widgets that happen then won't. Instead, a Persistent is
+    // used to extend the lifetime of this persisted widget
+    // beyond the plugin element's, so that it can be disposed
+    // of by the plugin element's finalizer.
+    //
+    // To prevent a leak from that, the plugin container does not
+    // keep a strong reference back to the plugin element.
+    // Not pretty.
+    GC_PLUGIN_IGNORE("")
+    RefPtrWillBePersistent<Widget> m_persistedPluginWidget;

[haraken, 2014/09/26 09:19:25]

Can we avoid this persistent handle by using the disposer pattern?

  PersistentHeapHashMap<WeakMember<HTMLFrameOwnerElement>,
OwnPtr<HTMLFrameOwnerElementDisposer>>;

You can destruct the Widget in the HTMLFrameOwnerElementDisposer's destructor.

[sof, 2014/09/28 17:03:52]

I don't think that would work: disposing of the widget by the time the
HTMLFrameOwnerElement is GCed would be too late. i.e., this needs to happen when
the HTMLPlugInElement is detached/disconnected
(HTMLPlugInElement::disconnectContentFrame().)

 };
 
 inline bool isHTMLPlugInElement(const HTMLElement& element)
 {
     return element.isPluginElement();
 }
 
 DEFINE_HTMLELEMENT_TYPE_CASTS_WITH_FUNCTION(HTMLPlugInElement);
 
 } // namespace blink
 
 #endif // HTMLPlugInElement_h