Move the Widget hierarchy to the Oilpan heap.

Source/core/frame/LocalFrame.h

Index: Source/core/frame/LocalFrame.h
diff --git a/Source/core/frame/LocalFrame.h b/Source/core/frame/LocalFrame.h
index af508f33ea38996f39e2088c9ae1abcaad758c7f..20f5ddd956ccc3d9e0e27d3348eee78707dfd9e5 100644
--- a/Source/core/frame/LocalFrame.h
+++ b/Source/core/frame/LocalFrame.h
@@ -51,6 +51,7 @@ namespace blink {
     class FrameDestructionObserver;
     class FrameSelection;
     class FrameView;
+    class HTMLPlugInElement;
     class InputMethodController;
     class IntPoint;
     class IntSize;
@@ -70,7 +71,7 @@ namespace blink {
         virtual bool isLocalFrame() const override { return true; }
 
         void init();
-        void setView(PassRefPtr<FrameView>);
+        void setView(PassRefPtrWillBeRawPtr<FrameView>);
         void createView(const IntSize&, const Color&, bool,
             ScrollbarMode = ScrollbarAuto, bool horizontalLock = false,
             ScrollbarMode = ScrollbarAuto, bool verticalLock = false);
@@ -156,6 +157,12 @@ namespace blink {
         bool shouldReuseDefaultView(const KURL&) const;
         void removeSpellingMarkersUnderWords(const Vector<String>& words);
 
+#if ENABLE(OILPAN)
+        void registerPluginElement(HTMLPlugInElement*);
+        void unregisterPluginElement(HTMLPlugInElement*);
+        void clearWeakMembers(Visitor*);
+#endif
+
     // ========
 
     private:
@@ -169,7 +176,7 @@ namespace blink {
         mutable FrameLoader m_loader;
         mutable NavigationScheduler m_navigationScheduler;
 
-        RefPtr<FrameView> m_view;
+        RefPtrWillBeMember<FrameView> m_view;
         // Usually 0. Non-null if this is the top frame of PagePopup.
         RefPtrWillBeMember<Element> m_pagePopupOwner;
 
@@ -179,7 +186,20 @@ namespace blink {
         const OwnPtrWillBeMember<FrameSelection> m_selection;
         const OwnPtrWillBeMember<EventHandler> m_eventHandler;
         const OwnPtrWillBeMember<FrameConsole> m_console;
-        OwnPtrWillBeMember<InputMethodController> m_inputMethodController;
+        const OwnPtrWillBeMember<InputMethodController> m_inputMethodController;
+
+#if ENABLE(OILPAN)
+        // Oilpan: in order to reliably finalize plugin elements with
+        // renderer-less plugins, the frame keeps track of them. When
+        // the frame is detached and disposed, these will be disposed
+        // of in the process. This is needed as the plugin element
+        // might not itself be attached to a DOM tree and be
+        // explicitly detached&disposed of.
+        //
+        // A weak reference is all wanted; the plugin element must
+        // otherwise be referenced and kept alive.
+        HeapHashSet<WeakMember<HTMLPlugInElement> > m_pluginElements;

[haraken, 2014/10/10 02:50:32]

This idea looks nice!

However, I want to understand one thing: Won't it be enough to register a
pre-finalizer to a Widget so that Widget::dispose() is called in the
pre-finalizer?

[sof, 2014/10/10 05:22:18]

dispose() of the plugin might trigger unbounded amounts of allocation, so
pre-finalizers aren't suitable.

+#endif
 
         float m_pageZoomFactor;
         float m_textZoomFactor;