Move the Widget hierarchy to the Oilpan heap.

Source/core/frame/FrameView.h

Index: Source/core/frame/FrameView.h
diff --git a/Source/core/frame/FrameView.h b/Source/core/frame/FrameView.h
index f3488f75d79d43e26f9854532e42ac37ef0739d1..f842000a64c7733d94d9bf0aee2733f5b6185a62 100644
--- a/Source/core/frame/FrameView.h
+++ b/Source/core/frame/FrameView.h
@@ -57,14 +57,13 @@ struct CompositedSelectionBound;
 
 typedef unsigned long long DOMTimeStamp;
 
-// FIXME: Oilpan: move Widget (and thereby FrameView) to the heap.
 class FrameView final : public ScrollView {
 public:
     friend class RenderView;
     friend class Internals;
 
-    static PassRefPtr<FrameView> create(LocalFrame*);
-    static PassRefPtr<FrameView> create(LocalFrame*, const IntSize& initialSize);
+    static PassRefPtrWillBeRawPtr<FrameView> create(LocalFrame*);
+    static PassRefPtrWillBeRawPtr<FrameView> create(LocalFrame*, const IntSize& initialSize);
 
     virtual ~FrameView();
 
@@ -85,7 +84,7 @@ public:
 
     virtual void setCanHaveScrollbars(bool) override;
 
-    virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation) override;
+    virtual PassRefPtrWillBeRawPtr<Scrollbar> createScrollbar(ScrollbarOrientation) override;
 
     virtual void setContentsSize(const IntSize&) override;
     IntPoint clampOffsetAtScale(const IntPoint& offset, float scale) const;
@@ -225,7 +224,7 @@ public:
     void incrementVisuallyNonEmptyPixelCount(const IntSize&);
     void setIsVisuallyNonEmpty() { m_isVisuallyNonEmpty = true; }
     void enableAutoSizeMode(const IntSize& minSize, const IntSize& maxSize);
-    void disableAutoSizeMode() { m_autoSizeInfo.clear(); }
+    void disableAutoSizeMode() { disposeAutoSizeInfo(); }
 
     void forceLayout(bool allowSubtree = false);
     void forceLayoutForPagination(const FloatSize& pageSize, const FloatSize& originalPageSize, float maximumShrinkFactor);
@@ -332,6 +331,8 @@ public:
     virtual GraphicsLayer* layerForVerticalScrollbar() const override;
     virtual GraphicsLayer* layerForScrollCorner() const override;
 
+    virtual void trace(Visitor*) override;
+
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta) override;
     virtual void scrollContentsSlowPath(const IntRect& updateRect) override;
@@ -346,6 +347,7 @@ protected:
 private:
     explicit FrameView(LocalFrame*);
 
+    void dispose();
     void reset();
     void init();
 
@@ -417,6 +419,8 @@ private:
 
     void setLayoutSizeInternal(const IntSize&);
 
+    void disposeAutoSizeInfo();
+
     bool paintInvalidationIsAllowed() const
     {
         return !isInPerformLayout() || canInvalidatePaintDuringPerformLayout();
@@ -428,18 +432,20 @@ private:
     LayoutSize m_size;
 
     typedef WillBeHeapHashSet<RefPtrWillBeMember<RenderEmbeddedObject> > EmbeddedObjectSet;
-    WillBePersistentHeapHashSet<RefPtrWillBeMember<RenderEmbeddedObject> > m_widgetUpdateSet;
+    WillBeHeapHashSet<RefPtrWillBeMember<RenderEmbeddedObject> > m_widgetUpdateSet;
 
     // FIXME: These are just "children" of the FrameView and should be RefPtr<Widget> instead.
-    WillBePersistentHeapHashSet<RefPtrWillBeMember<RenderWidget> > m_widgets;
+    WillBeHeapHashSet<RefPtrWillBeMember<RenderWidget> > m_widgets;
 
-    // Oilpan: the use of a persistent back reference 'emulates' the
-    // RefPtr-cycle that is kept between the two objects non-Oilpan.
+    // The RefPtr cycle between LocalFrame and FrameView is broken
+    // when a LocalFrame is detached by FrameLoader::detachFromParent().
+    // It clears the LocalFrame's m_view reference via setView(nullptr).
     //
-    // That cycle is broken when a LocalFrame is detached by
-    // FrameLoader::detachFromParent(), it then clears its
-    // FrameView's m_frame reference by calling setView(nullptr).
-    RefPtrWillBePersistent<LocalFrame> m_frame;
+    // For Oilpan, Member reference cycles pose no problem, but
+    // LocalFrame's FrameView is also cleared by setView(). This additionally
+    // triggers FrameView::dispose(), which performs the operations
+    // that cannot be delayed until finalization time.
+    RefPtrWillBeMember<LocalFrame> m_frame;
 
     bool m_doFullPaintInvalidation;
 
@@ -482,7 +488,7 @@ private:
     bool m_isTrackingPaintInvalidations; // Used for testing.
     Vector<IntRect> m_trackedPaintInvalidationRects;
 
-    RefPtrWillBePersistent<Node> m_nodeToDraw;
+    RefPtrWillBeMember<Node> m_nodeToDraw;
     PaintBehavior m_paintBehavior;
     bool m_isPainting;
 
@@ -491,15 +497,15 @@ private:
     bool m_isVisuallyNonEmpty;
     bool m_firstVisuallyNonEmptyLayoutCallbackPending;
 
-    RefPtrWillBePersistent<Node> m_maintainScrollPositionAnchor;
+    RefPtrWillBeMember<Node> m_maintainScrollPositionAnchor;
 
     // Renderer to hold our custom scroll corner.
-    RawPtrWillBePersistent<RenderScrollbarPart> m_scrollCorner;
+    RawPtrWillBeMember<RenderScrollbarPart> m_scrollCorner;
 
     OwnPtr<ScrollableAreaSet> m_scrollableAreas;
     OwnPtr<ResizerAreaSet> m_resizerAreas;
     OwnPtr<ViewportConstrainedObjectSet> m_viewportConstrainedObjects;
-    OwnPtr<FrameViewAutoSizeInfo> m_autoSizeInfo;
+    OwnPtrWillBeMember<FrameViewAutoSizeInfo> m_autoSizeInfo;
 
     float m_visibleContentScaleFactor;
     IntSize m_inputEventsOffsetForEmulation;
@@ -512,8 +518,13 @@ private:
 
     Vector<IntRect> m_tickmarks;
 
-    bool m_needsUpdateWidgetPositions;
     float m_topControlsViewportAdjustment;
+    bool m_needsUpdateWidgetPositions;
+
+#if ENABLE(OILPAN) && ENABLE(ASSERT)
+    // Verified when finalizing.
+    bool m_hasBeenDisposed;
+#endif
 };
 
 inline void FrameView::incrementVisuallyNonEmptyCharacterCount(unsigned count)
@@ -542,6 +553,7 @@ inline void FrameView::incrementVisuallyNonEmptyPixelCount(const IntSize& size)
 DEFINE_TYPE_CASTS(FrameView, Widget, widget, widget->isFrameView(), widget.isFrameView());
 
 class AllowPaintInvalidationScope {
+    STACK_ALLOCATED();
 public:
     explicit AllowPaintInvalidationScope(FrameView* view)
         : m_view(view)
@@ -560,8 +572,9 @@ public:
 
         m_view->setCanInvalidatePaintDuringPerformLayout(m_originalValue);
     }
+
 private:
-    FrameView* m_view;
+    RawPtrWillBeMember<FrameView> m_view;
     bool m_originalValue;
 };