Move the Widget hierarchy to the Oilpan heap.

Source/core/rendering/RenderScrollbar.h

Index: Source/core/rendering/RenderScrollbar.h
diff --git a/Source/core/rendering/RenderScrollbar.h b/Source/core/rendering/RenderScrollbar.h
index 99b609bed51aafdb3095a4649eb83c571a65b3a5..b55b30f018adcae3056f8d8af92ce2e73fa4f7bf 100644
--- a/Source/core/rendering/RenderScrollbar.h
+++ b/Source/core/rendering/RenderScrollbar.h
@@ -44,7 +44,7 @@ protected:
 
 public:
     friend class Scrollbar;
-    static PassRefPtr<Scrollbar> createCustomScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame* owningFrame = 0);
+    static PassRefPtrWillBeRawPtr<Scrollbar> createCustomScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame* owningFrame = 0);
     virtual ~RenderScrollbar();
 
     RenderBox* owningRenderer() const;
@@ -59,6 +59,8 @@ public:
 
     virtual bool isOverlayScrollbar() const OVERRIDE { return false; }
 
+    virtual void trace(Visitor*) OVERRIDE;
+
 private:
     virtual void setParent(Widget*) OVERRIDE;
     virtual void setEnabled(bool) OVERRIDE;
@@ -79,9 +81,18 @@ private:
     // so we keep a reference to the Node which caused this custom scrollbar creation.
     // This will not create a reference cycle as the Widget tree is owned by our containing
     // FrameView which this Node pointer can in no way keep alive. See webkit bug 80610.
-    RefPtrWillBePersistent<Node> m_owner;
-
-    LocalFrame* m_owningFrame;
+    RefPtrWillBeMember<Node> m_owner;
+
+    RawPtrWillBeMember<LocalFrame> m_owningFrame;
+
+    // FIXME: Oilpan: post-detach creation of RenderScrollbarPart
+    // objects (see ~RenderScrollbar comment) makes it difficult to
+    // ensure that all RenderScrollbarParts have been explicitly
+    // destroyed prior to finalization. To reliably address, a
+    // Persistent reference to the hash map is kept here, so that the
+    // RenderScrollbar finalizer can safely notify the 'parts' of
+    // destruction..before they're swept out the next time around.
+    GC_PLUGIN_IGNORE("")
     WillBePersistentHeapHashMap<unsigned, RawPtrWillBeMember<RenderScrollbarPart> > m_parts;

[haraken, 2014/09/29 14:16:36]

Hmm, this looks too tricky as well. The RenderScrollbarPart has a raw pointer
back to this RenderScrollBar. Once we make the raw pointer a
Member<RenderScrollBar> (conceptually we should do this), we will end up
creating a cycle... I guess we're relying on too many fragile assumptions here.

 };