Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLPlugInElement.h

Index: Source/core/html/HTMLPlugInElement.h
diff --git a/Source/core/html/HTMLPlugInElement.h b/Source/core/html/HTMLPlugInElement.h
index 1d2e302f4badcf807dea5f1ac3c5765a816b314c..3d7148bdd8c8378188c7e28c94531c924206d555 100644
--- a/Source/core/html/HTMLPlugInElement.h
+++ b/Source/core/html/HTMLPlugInElement.h
@@ -45,6 +45,9 @@ class HTMLPlugInElement : public HTMLFrameOwnerElement {
 public:
     virtual ~HTMLPlugInElement();
     virtual void trace(Visitor*) OVERRIDE;
+#if ENABLE(OILPAN)
+    virtual void disconnectContentFrame() OVERRIDE;
+#endif
 
     void resetInstance();
     SharedPersistent<v8::Object>* pluginWrapper();
@@ -143,7 +146,20 @@ private:
     // prevent confusing code which may assume that widget() != null
     // means the frame is active, we save off m_widget here while
     // the plugin is persisting but not being displayed.
-    RefPtr<Widget> m_persistedPluginWidget;
+    // ---
+    // Oilpan: a Persistent<> is used for finalization purposes.
+    // A renderer-less plugin element is not detached prior to
+    // finalization, so the required disposing of plugin container
+    // widgets that happen then won't. Instead, a Persistent is
+    // used to extend the lifetime of this persisted widget
+    // beyond the plugin element's, so that it can be disposed
+    // of by the plugin element's finalizer.
+    //
+    // To prevent a leak from that, the plugin container does not
+    // keep a strong reference back to the plugin element.
+    // Not pretty.
+    GC_PLUGIN_IGNORE("")
+    RefPtrWillBePersistent<Widget> m_persistedPluginWidget;

[haraken, 2014/09/29 14:16:36]

This is a bit too tricky... I think we need to seek a way to make this a Member.
See my comment in HTMLPluginElement.cpp as well.

 };
 
 inline bool isHTMLPlugInElement(const HTMLElement& element)