Move the Widget hierarchy to the Oilpan heap.

Source/web/WebPluginContainerImpl.cpp

Index: Source/web/WebPluginContainerImpl.cpp
diff --git a/Source/web/WebPluginContainerImpl.cpp b/Source/web/WebPluginContainerImpl.cpp
index 4adc15c159fa4b21adddec32ae9ebe0091593cd1..5ac64db363e1b5bec7e62a6a903b1038eef1f9ef 100644
--- a/Source/web/WebPluginContainerImpl.cpp
+++ b/Source/web/WebPluginContainerImpl.cpp
@@ -175,7 +175,7 @@ void WebPluginContainerImpl::handleEvent(Event* event)
     if (!m_webPlugin->acceptsInputEvents())
         return;
 
-    RefPtr<WebPluginContainerImpl> protector(this);
+    RefPtrWillBeRawPtr<WebPluginContainerImpl> protect(this);
     // The events we pass are defined at:
     //    http://devedge-temp.mozilla.org/library/manuals/2002/plugin/1.0/structures5.html#1000000
     // Don't take the documentation as truth, however.  There are many cases
@@ -674,14 +674,10 @@ bool WebPluginContainerImpl::paintCustomOverhangArea(GraphicsContext* context, c
 // Private methods -------------------------------------------------------------
 
 WebPluginContainerImpl::WebPluginContainerImpl(HTMLPlugInElement* element, WebPlugin* webPlugin)
-#if ENABLE(OILPAN)
-    : m_frame(element->document().frame())
-#else
     : FrameDestructionObserver(element->document().frame())
-#endif
     , m_element(element)
     , m_webPlugin(webPlugin)
-    , m_webLayer(0)
+    , m_webLayer(nullptr)
     , m_touchEventRequestType(TouchEventRequestTypeNone)
     , m_wantsWheelEvents(false)
 {
@@ -690,39 +686,38 @@ WebPluginContainerImpl::WebPluginContainerImpl(HTMLPlugInElement* element, WebPl
 WebPluginContainerImpl::~WebPluginContainerImpl()
 {
 #if ENABLE(OILPAN)
-    // The element (and its document) are heap allocated and may
-    // have been finalized by now; unsafe to unregister the touch
-    // event handler at this stage.
-    //
-    // This is acceptable, as the widget will unregister itself if it
-    // is cleanly detached. If an explicit detach doesn't happen, this
-    // container is assumed to have died with the plugin element (and
-    // its document), hence no unregistration step is needed.
-    //
-    m_element = 0;
+    // The plugin container must have been disposed of already.
+    ASSERT(!m_webPlugin);
 #else
+    dispose();
+#endif
+}
+
+void WebPluginContainerImpl::dispose()
+{
     if (m_touchEventRequestType != TouchEventRequestTypeNone && m_element->document().frameHost())
         m_element->document().frameHost()->eventHandlerRegistry().didRemoveEventHandler(*m_element, EventHandlerRegistry::TouchEvent);
-#endif
 
     ScriptForbiddenScope::AllowSuperUnsafeScript thisShouldBeRemoved;
 
     for (size_t i = 0; i < m_pluginLoadObservers.size(); ++i)
         m_pluginLoadObservers[i]->clearPluginContainer();
     m_webPlugin->destroy();
+    m_webPlugin = nullptr;
+
     if (m_webLayer)
         GraphicsLayer::unregisterContentsLayer(m_webLayer);
+
+    m_pluginLoadObservers.clear();
+    m_scrollbarGroup.clear();
+    m_element = nullptr;
 }
 
-#if ENABLE(OILPAN)
-void WebPluginContainerImpl::detach()
+void WebPluginContainerImpl::trace(Visitor* visitor)
 {
-    if (m_touchEventRequestType != TouchEventRequestTypeNone && m_element->document().frameHost())
-        m_element->document().frameHost()->eventHandlerRegistry().didRemoveEventHandler(*m_element, EventHandlerRegistry::TouchEvent);
-
-    setWebLayer(0);
+    FrameDestructionObserver::trace(visitor);
+    PluginView::trace(visitor);
 }
-#endif
 
 void WebPluginContainerImpl::handleMouseEvent(MouseEvent* event)
 {