Move the Widget hierarchy to the Oilpan heap.

Source/web/PopupListBox.h

 /*
  * Copyright (c) 2011, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 70 matching lines @@
     int yOffset; // y offset of this item, relative to the top of the popup.
     TextDirection textDirection;
     bool hasTextDirectionOverride;
     bool enabled;
     bool displayNone;
 };
 
 // This class manages the scrollable content inside a <select> popup.
 class PopupListBox final : public Widget, public ScrollableArea, public PopupContent {
 public:
-    static PassRefPtr<PopupListBox> create(PopupMenuClient* client, bool deviceSupportsTouch, PopupContainer* container)
+    static PassRefPtrWillBeRawPtr<PopupListBox> create(PopupMenuClient* client, bool deviceSupportsTouch, PopupContainer* container)
     {
-        return adoptRef(new PopupListBox(client, deviceSupportsTouch, container));
+        return adoptRefWillBeNoop(new PopupListBox(client, deviceSupportsTouch, container));
     }
 
     // Widget
     virtual void invalidateRect(const IntRect&) override;
     virtual void paint(GraphicsContext*, const IntRect&) override;
     virtual HostWindow* hostWindow() const override;
     virtual void setFrameRect(const IntRect&) override;
     virtual IntPoint convertChildToSelf(const Widget* child, const IntPoint&) const override;
     virtual IntPoint convertSelfToChild(const Widget* child, const IntPoint&) const override;
 
@@ skipping 70 matching lines @@
     virtual void setMaxWidthAndLayout(int) override;
 
     void disconnectClient() { m_popupClient = 0; }
 
     const Vector<PopupItem*>& items() const { return m_items; }
 
     virtual int popupContentHeight() const override;
 
     static const int defaultMaxHeight;
 
+    void trace(Visitor*) OVERRIDE;
+
 protected:
     virtual void invalidateScrollCornerRect(const IntRect&) override { }
 
 private:
     friend class PopupContainer;
     friend class RefCounted<PopupListBox>;
 
     PopupListBox(PopupMenuClient*, bool deviceSupportsTouch, PopupContainer*);
     virtual ~PopupListBox();
 
@@ skipping 87 matching lines @@
     int m_maxHeight;
 
     // A list of the options contained within the <select>
     Vector<PopupItem*> m_items;
 
     // The <select> PopupMenuClient that opened us.
     PopupMenuClient* m_popupClient;
 
     // The scrollbar which has mouse capture. Mouse events go straight to this
     // if not null.
-    RefPtr<Scrollbar> m_capturingScrollbar;
+    RefPtrWillBeMember<Scrollbar> m_capturingScrollbar;
 
     // The last scrollbar that the mouse was over. Used for mouseover highlights.
-    RefPtr<Scrollbar> m_lastScrollbarUnderMouse;
+    RefPtrWillBeMember<Scrollbar> m_lastScrollbarUnderMouse;
 
     // The string the user has typed so far into the popup. Used for typeAheadFind.
     String m_typedString;
 
     // The char the user has hit repeatedly. Used for typeAheadFind.
     UChar m_repeatingChar;
 
     // The last time the user hit a key. Used for typeAheadFind.
     TimeStamp m_lastCharTime;
 
     // If width exeeds screen width, we have to clip it.
     int m_maxWindowWidth;
 
     // To forward last mouse release event.
-    RefPtrWillBePersistent<Element> m_focusedElement;
+    RefPtrWillBeMember<Element> m_focusedElement;
 
-    PopupContainer* m_container;
+    // Oilpan: the container owns/wraps this listbox. A (strong)
+    // Member can be used for the back reference without extending the
+    // container's lifetime; the two objects live equally long.
+    RawPtrWillBeMember<PopupContainer> m_container;
 
-    RefPtr<Scrollbar> m_verticalScrollbar;
+    RefPtrWillBeMember<Scrollbar> m_verticalScrollbar;
     IntSize m_contentsSize;
     IntPoint m_scrollOffset;
 };
 
 } // namespace blink
 
 #endif