Move the Widget hierarchy to the Oilpan heap.

Source/core/frame/LocalFrame.cpp

Index: Source/core/frame/LocalFrame.cpp
diff --git a/Source/core/frame/LocalFrame.cpp b/Source/core/frame/LocalFrame.cpp
index 94f545258d10333e6848572bd05140e53f29282d..58876ab642da65d161d1b1dcdb56d6786e6dcbd6 100644
--- a/Source/core/frame/LocalFrame.cpp
+++ b/Source/core/frame/LocalFrame.cpp
@@ -93,7 +93,7 @@ inline LocalFrame::LocalFrame(FrameLoaderClient* client, FrameHost* host, FrameO
     : Frame(client, host, owner)
     , m_loader(this)
     , m_navigationScheduler(this)
-    , m_script(adoptPtr(new ScriptController(this)))
+    , m_script(ScriptController::create(this))
     , m_editor(Editor::create(*this))
     , m_spellChecker(SpellChecker::create(*this))
     , m_selection(FrameSelection::create(this))
@@ -145,6 +145,7 @@ void LocalFrame::trace(Visitor* visitor)
     visitor->trace(m_destructionObservers);
     visitor->trace(m_loader);
     visitor->trace(m_navigationScheduler);
+    visitor->trace(m_view);
     visitor->trace(m_pagePopupOwner);
     visitor->trace(m_editor);
     visitor->trace(m_spellChecker);
@@ -201,7 +202,7 @@ void LocalFrame::detachView()
         m_view->prepareForDetach();
 }
 
-void LocalFrame::setView(PassRefPtr<FrameView> view)
+void LocalFrame::setView(PassRefPtrWillBeRawPtr<FrameView> view)
 {
     detachView();
 
@@ -215,6 +216,9 @@ void LocalFrame::setView(PassRefPtr<FrameView> view)
 
     eventHandler().clear();
 
+    if (m_view && !view)

[haraken, 2014/09/29 14:16:36]

What is the '&& !view' check for?

How about calling m_view->dispose() in FrameView::prepareForDetach() ?

[haraken, 2014/10/03 15:02:58]

Would you reply to this question?

[sof, 2014/10/07 11:03:36]

I've now tweaked the predicate.
That would make the disposal happen _slightly_ earlier -- before the document is
informed of pending destruction, which detaches its RenderView -- which
conflicts with what dispose() assumes:

 ASSERT(m_frame->view() != this || !m_frame->contentRenderer());

i.e., we're disposing something that's not referred to from the LocalFrame _or_
that frame is itself detached & being destructed.

I don't think verifying that condition adds enough value for Oilpan (cf the
assert flag we have for disposal now), but I kept it non-Oilpan by moving it
into the dtor.

IOW.. :-) it makes some sense to have prepareForDetach() also take care of
disposing, hence now done. wdyt?

+        m_view->dispose();
+
     m_view = view;
 
     if (m_view && isMainFrame()) {
@@ -442,7 +446,7 @@ void LocalFrame::createView(const IntSize& viewportSize, const Color& background
 
     setView(nullptr);
 
-    RefPtr<FrameView> frameView;
+    RefPtrWillBeRawPtr<FrameView> frameView = nullptr;
     if (isLocalRoot) {
         frameView = FrameView::create(this, viewportSize);