Move the Widget hierarchy to the Oilpan heap.

Source/core/rendering/RenderScrollbar.cpp

Index: Source/core/rendering/RenderScrollbar.cpp
diff --git a/Source/core/rendering/RenderScrollbar.cpp b/Source/core/rendering/RenderScrollbar.cpp
index 05520a317f4ef3ba992b7781ab845b2713c62f91..a4f860e8ea093d4d7027d1a90320e08a722e418c 100644
--- a/Source/core/rendering/RenderScrollbar.cpp
+++ b/Source/core/rendering/RenderScrollbar.cpp
@@ -36,9 +36,9 @@
 
 namespace blink {
 
-PassRefPtr<Scrollbar> RenderScrollbar::createCustomScrollbar(ScrollableArea* scrollableArea, ScrollbarOrientation orientation, Node* ownerNode, LocalFrame* owningFrame)
+PassRefPtrWillBeRawPtr<Scrollbar> RenderScrollbar::createCustomScrollbar(ScrollableArea* scrollableArea, ScrollbarOrientation orientation, Node* ownerNode, LocalFrame* owningFrame)
 {
-    return adoptRef(new RenderScrollbar(scrollableArea, orientation, ownerNode, owningFrame));
+    return adoptRefWillBeNoop(new RenderScrollbar(scrollableArea, orientation, ownerNode, owningFrame));
 }
 
 RenderScrollbar::RenderScrollbar(ScrollableArea* scrollableArea, ScrollbarOrientation orientation, Node* ownerNode, LocalFrame* owningFrame)
@@ -75,10 +75,22 @@ RenderScrollbar::~RenderScrollbar()
         // Meanwhile, we can have a call to updateScrollbarPart which recreates the
         // scrollbar part. So, we need to destroy these parts since we don't want them
         // to call on a destroyed scrollbar. See webkit bug 68009.

[haraken, 2014/09/29 14:16:36]

The culprit of the complexity is this bug. How hard do you think to fix the bug?

[sof, 2014/10/02 14:03:54]

Someone with rendering knowledge is better qualified to answer that. Much better
:)

+        //
+        // Oilpan: see comment next to m_parts declaration why this is
+        // safe to do and required.
         updateScrollbarParts(true);
     }
 }
 
+void RenderScrollbar::trace(Visitor* visitor)
+{
+#if ENABLE(OILPAN)
+    visitor->trace(m_owner);
+    visitor->trace(m_owningFrame);
+#endif
+    Scrollbar::trace(visitor);
+}
+
 RenderBox* RenderScrollbar::owningRenderer() const
 {
     if (m_owningFrame) {