Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLFrameOwnerElement.h

Index: Source/core/html/HTMLFrameOwnerElement.h
diff --git a/Source/core/html/HTMLFrameOwnerElement.h b/Source/core/html/HTMLFrameOwnerElement.h
index 94ed55576faa3e7f6ed3b260782a8ee81f73bc15..5aa2af37ecd483fde63579178614451676484f7b 100644
--- a/Source/core/html/HTMLFrameOwnerElement.h
+++ b/Source/core/html/HTMLFrameOwnerElement.h
@@ -48,7 +48,7 @@ public:
     void setContentFrame(Frame&);
     void clearContentFrame();
 
-    void disconnectContentFrame();
+    virtual void disconnectContentFrame();
 
     // Most subclasses use RenderPart (either RenderEmbeddedObject or RenderIFrame)
     // except for HTMLObjectElement and HTMLEmbedElement which may return any
@@ -65,7 +65,7 @@ public:
     virtual void renderFallbackContent() { }
 
     virtual bool isObjectElement() const { return false; }
-    void setWidget(PassRefPtr<Widget>);
+    void setWidget(PassRefPtrWillBeRawPtr<Widget>);
     Widget* ownedWidget() const;
 
     class UpdateSuspendScope {
@@ -79,6 +79,10 @@ public:
 
     virtual void trace(Visitor*) OVERRIDE;
 
+#if ENABLE(OILPAN)
+    static void disposeWidget(Widget*);
+#endif
+
 protected:
     HTMLFrameOwnerElement(const QualifiedName& tagName, Document&);
     void setSandboxFlags(SandboxFlags);
@@ -95,7 +99,7 @@ private:
     virtual void dispatchLoad() OVERRIDE;
 
     RawPtrWillBeMember<Frame> m_contentFrame;
-    RefPtr<Widget> m_widget;
+    RefPtrWillBeMember<Widget> m_widget;
     SandboxFlags m_sandboxFlags;
 };