Move the Widget hierarchy to the Oilpan heap.

Source/core/accessibility/AXScrollView.h

Index: Source/core/accessibility/AXScrollView.h
diff --git a/Source/core/accessibility/AXScrollView.h b/Source/core/accessibility/AXScrollView.h
index fbe205301e42f7ab1cda1d146f17dd49d697d7a0..2565ff7ef4862c90109273e85244a6e457fd562f 100644
--- a/Source/core/accessibility/AXScrollView.h
+++ b/Source/core/accessibility/AXScrollView.h
@@ -75,6 +75,11 @@ private:
     AXScrollbar* addChildScrollbar(Scrollbar*);
     void removeChildScrollbar(AXObject*);
 
+    // FIXME: Oilpan: Frame/ScrollView is on the heap, but can we
+    // assume that the corresponding AXScrollView is retired from
+    // the AX cache before it is finalized? If so, maintaining
+    // this as a bare pointer appears preferable. A persistent
+    // could create a leak.
     ScrollView* m_scrollView;

[haraken, 2014/09/26 09:19:25]

Just to confirm: m_scrollView shouldn't become a stale pointer because
m_scrollView is explicitly cleared in AXScrollView::detach(), right?

[sof, 2014/09/28 08:05:52]

That's correct, and detaching happens when the AX object cache is updated(and
finalized.)

I don't understand (yet) why it is non-leaky to keep Persistent<> back
references from AXObject-derived objects to on-heap ones, esp something as "big"
as ScrollView, so I've not done so here.

     RefPtr<AXObject> m_horizontalScrollbar;
     RefPtr<AXObject> m_verticalScrollbar;