Move the Widget hierarchy to the Oilpan heap.

Source/core/rendering/RenderScrollbar.h

 /*
  * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 26 matching lines @@
 class RenderBox;
 class RenderScrollbarPart;
 class RenderStyle;
 
 class RenderScrollbar FINAL : public Scrollbar {
 protected:
     RenderScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame*);
 
 public:
     friend class Scrollbar;
-    static PassRefPtr<Scrollbar> createCustomScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame* owningFrame = 0);
+    static PassRefPtrWillBeRawPtr<Scrollbar> createCustomScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame* owningFrame = 0);
     virtual ~RenderScrollbar();
 
     RenderBox* owningRenderer() const;
 
     void paintPart(GraphicsContext*, ScrollbarPart, const IntRect&);
 
     IntRect buttonRect(ScrollbarPart);
     IntRect trackRect(int startLength, int endLength);
     IntRect trackPieceRectWithMargins(ScrollbarPart, const IntRect&);
 
     int minimumThumbLength();
 
     virtual bool isOverlayScrollbar() const OVERRIDE { return false; }
 
+    virtual void trace(Visitor*) OVERRIDE;
+
 private:
     virtual void setParent(Widget*) OVERRIDE;
     virtual void setEnabled(bool) OVERRIDE;
 
     virtual void setHoveredPart(ScrollbarPart) OVERRIDE;
     virtual void setPressedPart(ScrollbarPart) OVERRIDE;
 
     virtual void styleChanged() OVERRIDE;
 
     virtual bool isCustomScrollbar() const OVERRIDE { return true; }
 
     void updateScrollbarParts(bool destroy = false);
 
     PassRefPtr<RenderStyle> getScrollbarPseudoStyle(ScrollbarPart, PseudoId);
     void updateScrollbarPart(ScrollbarPart, bool destroy = false);
 
     // This Scrollbar(Widget) may outlive the DOM which created it (during tear down),
     // so we keep a reference to the Node which caused this custom scrollbar creation.
     // This will not create a reference cycle as the Widget tree is owned by our containing
     // FrameView which this Node pointer can in no way keep alive. See webkit bug 80610.
-    RefPtrWillBePersistent<Node> m_owner;
+    RefPtrWillBeMember<Node> m_owner;
 
-    LocalFrame* m_owningFrame;
+    RawPtrWillBeMember<LocalFrame> m_owningFrame;
+
+    // FIXME: Oilpan: post-detach creation of RenderScrollbarPart
+    // objects (see ~RenderScrollbar comment) makes it difficult to
+    // ensure that all RenderScrollbarParts have been explicitly
+    // destroyed prior to finalization. To reliably address, a
+    // Persistent reference to the hash map is kept here, so that the
+    // RenderScrollbar finalizer can safely notify the 'parts' of
+    // destruction..before they're swept out the next time around.
+    GC_PLUGIN_IGNORE("")
     WillBePersistentHeapHashMap<unsigned, RawPtrWillBeMember<RenderScrollbarPart> > m_parts;

[haraken, 2014/09/26 09:19:25]

Can we use a disposer pattern to delay the finalization of the
RenderScrollbarPart objects?

  PersistentHeapHashMap<WeakMember<RenderScrollbar>,
OwnPtr<RenderScrollbarDisposer>>;


You can destruct RenderScrollbarPart objects in the destructor of
RenderScrollbarDisposer.

[sof, 2014/09/28 21:11:25]

That map would have to be global, right? RenderScrollbarPart is also on the
heap, so you presumably would have to generalize to something like

  PersistentHeapHashMap<WeakMember<RenderScrollbar>,
Member<RenderScrollbarPartSet>>

where RenderScrollbarPartSet would be

class RenderScrollbarPartSet : public GarbageCollected<..> {
 ...
 private:
     HeapHashSet<unsigned, Member<RenderScrollbarPart>> m_parts;
};

and then have a weak callback on the HeapHashMap (via a wrapper object that's
also on the heap & what the Persistent<> above holds onto. That weak callback
would then do the needed disposal of the RenderScrollbarPartSet.

An indirect arrangement, but it would save having a per RenderScrollbar
persistent. Does it have other merits?

[sof, 2014/10/07 15:30:37]

Used a pre-finalizer to handle this instead; no Persistent needed, I hope.

 };
 
 DEFINE_TYPE_CASTS(RenderScrollbar, ScrollbarThemeClient, scrollbar, scrollbar->isCustomScrollbar(), scrollbar.isCustomScrollbar());
 
 } // namespace blink
 
 #endif // RenderScrollbar_h