Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLPlugInElement.cpp

Index: Source/core/html/HTMLPlugInElement.cpp
diff --git a/Source/core/html/HTMLPlugInElement.cpp b/Source/core/html/HTMLPlugInElement.cpp
index 107e71308eda5e0c611ebd75b42bfd9485e59875..51d2cb231ead15ee4dc7e7e3b3a82018022c5184 100644
--- a/Source/core/html/HTMLPlugInElement.cpp
+++ b/Source/core/html/HTMLPlugInElement.cpp
@@ -77,6 +77,11 @@ HTMLPlugInElement::~HTMLPlugInElement()
     ASSERT(!m_pluginWrapper); // cleared in detach()
     ASSERT(!m_isDelayingLoadEvent);
 
+#if ENABLE(OILPAN)
+    if (m_persistedPluginWidget)
+        HTMLFrameOwnerElement::disposeWidget(m_persistedPluginWidget.get());
+#endif
+
     if (m_NPObject) {
         _NPN_ReleaseObject(m_NPObject);
         m_NPObject = 0;
@@ -86,9 +91,19 @@ HTMLPlugInElement::~HTMLPlugInElement()
 void HTMLPlugInElement::trace(Visitor* visitor)
 {
     visitor->trace(m_imageLoader);
+    visitor->trace(m_persistedPluginWidget);
     HTMLFrameOwnerElement::trace(visitor);
 }
 
+#if ENABLE(OILPAN)
+void HTMLPlugInElement::disconnectContentFrame()
+{
+    if (m_persistedPluginWidget)
+        HTMLFrameOwnerElement::disposeWidget(m_persistedPluginWidget.get());
+    HTMLFrameOwnerElement::disconnectContentFrame();
+}
+#endif
+
 bool HTMLPlugInElement::canProcessDrag() const
 {
     return pluginWidget() && pluginWidget()->isPluginView() && toPluginView(pluginWidget())->canProcessDrag();
@@ -202,12 +217,9 @@ void HTMLPlugInElement::detach(const AttachContext& context)
     Widget* plugin = ownedWidget();
     if (plugin && plugin->pluginShouldPersist())
         m_persistedPluginWidget = plugin;
-#if ENABLE(OILPAN)
-    else if (plugin)
-        plugin->detach();
-#endif
+
     resetInstance();
-    // FIXME - is this next line necessary?
+    // Clear the widget; will trigger disposal of it with Oilpan.
     setWidget(nullptr);
 
     if (m_isCapturingMouseEvents) {
@@ -335,7 +347,7 @@ void HTMLPlugInElement::defaultEventHandler(Event* event)
         if (toRenderEmbeddedObject(r)->showsUnavailablePluginIndicator())
             return;
     }
-    RefPtr<Widget> widget = toRenderWidget(r)->widget();
+    RefPtrWillBeRawPtr<Widget> widget = toRenderWidget(r)->widget();
     if (!widget)
         return;
     widget->handleEvent(event);
@@ -475,7 +487,7 @@ bool HTMLPlugInElement::loadPlugin(const KURL& url, const String& mimeType, cons
     WTF_LOG(Plugins, "   Loaded URL: %s", url.string().utf8().data());
     m_loadedUrl = url;
 
-    RefPtr<Widget> widget = m_persistedPluginWidget;
+    RefPtrWillBeRawPtr<Widget> widget = m_persistedPluginWidget;
     if (!widget) {
         bool loadManually = document().isPluginDocument() && !document().containsPlugins();
         FrameLoaderClient::DetachedPluginPolicy policy = requireRenderer ? FrameLoaderClient::FailOnDetachedPlugin : FrameLoaderClient::AllowDetachedPlugin;