Move the Widget hierarchy to the Oilpan heap.

Source/web/PopupMenuChromium.cpp

Index: Source/web/PopupMenuChromium.cpp
diff --git a/Source/web/PopupMenuChromium.cpp b/Source/web/PopupMenuChromium.cpp
index 053e716d3572d27b36f9dfddafd539f269f46039..6896fbdbeff0bc4e603175adb0a003a0ab08e2f6 100644
--- a/Source/web/PopupMenuChromium.cpp
+++ b/Source/web/PopupMenuChromium.cpp
@@ -47,12 +47,29 @@ PopupMenuChromium::PopupMenuChromium(LocalFrame& frame, PopupMenuClient* client)
 
 PopupMenuChromium::~PopupMenuChromium()
 {
+#if ENABLE(OILPAN)
+    // Verify that dispose() has been called when disconnecting.
+    ASSERT(!m_popupClient);
+#else
+    dispose();
+#endif
+}
+
+void PopupMenuChromium::dispose()
+{
     // When the PopupMenuChromium is destroyed, the client could already have been deleted.
     if (m_popup)
         m_popup->disconnectClient();
     hide();
 }
 
+void PopupMenuChromium::trace(Visitor* visitor)
+{
+    visitor->trace(m_frameView);
+    visitor->trace(m_popup);
+    PopupMenu::trace(visitor);
+}
+
 void PopupMenuChromium::show(const FloatQuad& controlPosition, const IntSize& controlSize, int index)
 {
     if (!m_popup) {
@@ -77,6 +94,13 @@ void PopupMenuChromium::updateFromElement()
 void PopupMenuChromium::disconnectClient()
 {
     m_popupClient = 0;
+#if ENABLE(OILPAN)
+    // Cannot be done during finalization, so instead done when the
+    // render object is destroyed and disconnected.
+    //
+    // FIXME: do this always, regardless of ENABLE(OILPAN).
+    dispose();
+#endif
 }
 
 } // namespace blink