Move the Widget hierarchy to the Oilpan heap.

Source/platform/scroll/Scrollbar.h

Index: Source/platform/scroll/Scrollbar.h
diff --git a/Source/platform/scroll/Scrollbar.h b/Source/platform/scroll/Scrollbar.h
index 27d46b98d99954612a2027176326d54a1e0afd19..0b649a35138dd898c66c135b8f06ed053cd52ce3 100644
--- a/Source/platform/scroll/Scrollbar.h
+++ b/Source/platform/scroll/Scrollbar.h
@@ -28,6 +28,7 @@
 
 #include "platform/Timer.h"
 #include "platform/Widget.h"
+#include "platform/heap/Handle.h"
 #include "platform/scroll/ScrollTypes.h"
 #include "platform/scroll/ScrollbarThemeClient.h"
 #include "wtf/MathExtras.h"
@@ -39,15 +40,15 @@ class GraphicsContext;
 class IntRect;
 class PlatformGestureEvent;
 class PlatformMouseEvent;
+class ScrollAnimator;
 class ScrollableArea;
 class ScrollbarTheme;
 class ScrollView;
 
-class PLATFORM_EXPORT Scrollbar : public Widget,
-                  public ScrollbarThemeClient {
+class PLATFORM_EXPORT Scrollbar : public Widget, public ScrollbarThemeClient {
 
 public:
-    static PassRefPtr<Scrollbar> create(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize);
+    static PassRefPtrWillBeRawPtr<Scrollbar> create(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize);
 
     virtual ~Scrollbar();
 
@@ -100,7 +101,7 @@ public:
     // Called by the ScrollableArea when the scroll offset changes.
     void offsetDidChange();
 
-    void disconnectFromScrollableArea() { m_scrollableArea = 0; }
+    void disconnectFromScrollableArea();
     ScrollableArea* scrollableArea() const { return m_scrollableArea; }
 
     int pressedPos() const { return m_pressedPos; }
@@ -168,6 +169,13 @@ protected:
     ScrollbarControlSize m_controlSize;
     ScrollbarTheme* m_theme;

[haraken, 2014/09/29 14:16:36]

Are you sure that this raw pointer doesn't become a stale pointer?

[sof, 2014/10/09 07:35:34]

It is always a reference to a statically allocated ScrollbarTheme
(RenderScrollbarTheme::renderScrollbarTheme(), ScrollbarTheme::theme(), or
ScrollbarTheme::nativeTheme()), so that should be fine.

We explicitly unregister when finalizing, so stale pointers in the other cannot
arise either. (Not clear that they're ever kept, but still.)

 
+#if ENABLE(OILPAN)
+    // To simplify Oilpan finalization, keep a copy of the ScrollableArea's
+    // scroll animator. Scrollbar is responsible for notifying the animator
+    // when it is destructed.
+    RefPtr<ScrollAnimator> m_animator;
+#endif
+
     int m_visibleSize;
     int m_totalSize;
     float m_currentPos;