Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLPlugInElement.h

Index: Source/core/html/HTMLPlugInElement.h
diff --git a/Source/core/html/HTMLPlugInElement.h b/Source/core/html/HTMLPlugInElement.h
index e12d391b2b6fc2225b31dab07c534e868a555dd7..493ca52455a3f0a4796cbbd28744aee12b6160ac 100644
--- a/Source/core/html/HTMLPlugInElement.h
+++ b/Source/core/html/HTMLPlugInElement.h
@@ -45,6 +45,10 @@ class HTMLPlugInElement : public HTMLFrameOwnerElement {
 public:
     virtual ~HTMLPlugInElement();
     virtual void trace(Visitor*) override;
+#if ENABLE(OILPAN)
+    virtual void disconnectContentFrame() override;
+    void setIsAllowedToDisposePlugin();
+#endif
 
     void resetInstance();
     SharedPersistent<v8::Object>* pluginWrapper();
@@ -131,6 +135,8 @@ private:
     bool pluginIsLoadable(const KURL&, const String& mimeType);
     bool wouldLoadAsNetscapePlugin(const String& url, const String& serviceType);
 
+    void setPersistedPluginWidget(Widget*);
+
     mutable RefPtr<SharedPersistent<v8::Object> > m_pluginWrapper;
     NPObject* m_NPObject;
     bool m_isCapturingMouseEvents;
@@ -143,7 +149,7 @@ private:
     // prevent confusing code which may assume that widget() != null
     // means the frame is active, we save off m_widget here while
     // the plugin is persisting but not being displayed.
-    RefPtr<Widget> m_persistedPluginWidget;
+    RefPtrWillBeMember<Widget> m_persistedPluginWidget;
 };
 
 inline bool isHTMLPlugInElement(const HTMLElement& element)