Move the Widget hierarchy to the Oilpan heap.

Source/core/frame/LocalFrame.cpp

Index: Source/core/frame/LocalFrame.cpp
diff --git a/Source/core/frame/LocalFrame.cpp b/Source/core/frame/LocalFrame.cpp
index 916523fffbc02f60db2d6863948169a5eb8b607f..faa1839b7bae061edc7ef02cdfc1430e8a460a70 100644
--- a/Source/core/frame/LocalFrame.cpp
+++ b/Source/core/frame/LocalFrame.cpp
@@ -48,6 +48,7 @@
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/Settings.h"
 #include "core/html/HTMLFrameElementBase.h"
+#include "core/html/HTMLPlugInElement.h"
 #include "core/inspector/ConsoleMessageStorage.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/loader/FrameLoaderClient.h"
@@ -145,6 +146,7 @@ void LocalFrame::trace(Visitor* visitor)
     visitor->trace(m_destructionObservers);
     visitor->trace(m_loader);
     visitor->trace(m_navigationScheduler);
+    visitor->trace(m_view);
     visitor->trace(m_pagePopupOwner);
     visitor->trace(m_script);
     visitor->trace(m_editor);
@@ -153,11 +155,23 @@ void LocalFrame::trace(Visitor* visitor)
     visitor->trace(m_eventHandler);
     visitor->trace(m_console);
     visitor->trace(m_inputMethodController);
+    visitor->trace(m_pluginElements);
+    visitor->registerWeakMembers<LocalFrame, &LocalFrame::clearWeakMembers>(this);
     HeapSupplementable<LocalFrame>::trace(visitor);
 #endif
     Frame::trace(visitor);
 }
 
+#if ENABLE(OILPAN)
+void LocalFrame::clearWeakMembers(Visitor* visitor)
+{
+    for (HeapHashSet<WeakMember<HTMLPlugInElement> >::const_iterator it = m_pluginElements.begin(); it != m_pluginElements.end(); ++it) {
+        if (!visitor->isAlive(*it))
+            (*it)->setIsAllowedToDisposePlugin();
+    }
+}
+#endif
+
 void LocalFrame::navigate(Document& originDocument, const KURL& url, bool lockBackForwardList)
 {
     m_navigationScheduler.scheduleLocationChange(&originDocument, url.string(), lockBackForwardList);
@@ -202,8 +216,9 @@ void LocalFrame::detachView()
         m_view->prepareForDetach();
 }
 
-void LocalFrame::setView(PassRefPtr<FrameView> view)
+void LocalFrame::setView(PassRefPtrWillBeRawPtr<FrameView> view)
 {
+    ASSERT(!m_view || m_view != view);
     detachView();
 
     // Prepare for destruction now, so any unload event handlers get run and the LocalDOMWindow is
@@ -448,7 +463,7 @@ void LocalFrame::createView(const IntSize& viewportSize, const Color& background
 
     setView(nullptr);
 
-    RefPtr<FrameView> frameView;
+    RefPtrWillBeRawPtr<FrameView> frameView = nullptr;
     if (isLocalRoot) {
         frameView = FrameView::create(this, viewportSize);
 
@@ -723,6 +738,12 @@ void LocalFrame::disconnectOwnerElement()
         if (Document* document = this->document())
             document->topDocument().clearAXObjectCache();
 #if ENABLE(OILPAN)
+        // First give the plugin elements holding persisted,
+        // renderer-less the opportunity to dispose of their plugins.

[haraken, 2014/10/10 02:50:32]

renderer-less => renderer-less plugins

[sof, 2014/10/10 08:40:55]

Done.

+        for (HeapHashSet<WeakMember<HTMLPlugInElement> >::const_iterator it = m_pluginElements.begin(); it != m_pluginElements.end(); ++it)
+            (*it)->disconnectContentFrame();
+        m_pluginElements.clear();
+
         // Clear the FrameView and FrameLoader right here rather than
         // during finalization. Too late to access various heap objects
         // at that stage.
@@ -747,4 +768,17 @@ void LocalFrame::setPagePopupOwner(Element& owner)
     m_pagePopupOwner = &owner;
 }
 
+#if ENABLE(OILPAN)
+void LocalFrame::registerPluginElement(HTMLPlugInElement* plugin)
+{
+    m_pluginElements.add(plugin);
+}
+
+void LocalFrame::unregisterPluginElement(HTMLPlugInElement* plugin)

[haraken, 2014/10/10 02:50:32]

Shall we add:

ASSERT(!ThreadState::isSweepInProgress());

?

[sof, 2014/10/10 08:40:55]

That should hold, done (but a bit surprised why you thought of the need for it
here.)

+{
+    ASSERT(m_pluginElements.contains(plugin));
+    m_pluginElements.remove(plugin);
+}
+#endif
+
 } // namespace blink