Move the Widget hierarchy to the Oilpan heap.

Source/core/frame/LocalFrame.cpp

Index: Source/core/frame/LocalFrame.cpp
diff --git a/Source/core/frame/LocalFrame.cpp b/Source/core/frame/LocalFrame.cpp
index 9c32d1e80efeb8b446a097cd40902fbc0a818a0c..bda7218d8358b434adafb244dbc0a7e948db180b 100644
--- a/Source/core/frame/LocalFrame.cpp
+++ b/Source/core/frame/LocalFrame.cpp
@@ -93,7 +93,7 @@ inline LocalFrame::LocalFrame(FrameLoaderClient* client, FrameHost* host, FrameO
     : Frame(client, host, owner)
     , m_loader(this)
     , m_navigationScheduler(this)
-    , m_script(adoptPtr(new ScriptController(this)))
+    , m_script(ScriptController::create(this))
     , m_editor(Editor::create(*this))
     , m_spellChecker(SpellChecker::create(*this))
     , m_selection(FrameSelection::create(this))
@@ -145,6 +145,7 @@ void LocalFrame::trace(Visitor* visitor)
     visitor->trace(m_destructionObservers);
     visitor->trace(m_loader);
     visitor->trace(m_navigationScheduler);
+    visitor->trace(m_view);
     visitor->trace(m_pagePopupOwner);
     visitor->trace(m_editor);
     visitor->trace(m_spellChecker);
@@ -196,7 +197,7 @@ void LocalFrame::detachView()
         m_view->prepareForDetach();
 }
 
-void LocalFrame::setView(PassRefPtr<FrameView> view)
+void LocalFrame::setView(PassRefPtrWillBeRawPtr<FrameView> view)
 {
     detachView();
 
@@ -210,6 +211,9 @@ void LocalFrame::setView(PassRefPtr<FrameView> view)
 
     eventHandler().clear();
 
+    if (m_view && !view)
+        m_view->dispose();

[haraken, 2014/09/26 09:19:25]

Just help me understand: Why is it OK to promptly dispose the FrameView here?
Isn't it possible there are other holders of the FrameView?

[sof, 2014/09/28 08:05:53]

A key question. I think it would be safer if the disposal happened at the
outermost "protect" holder, should there be any. This would only be observable
with Oilpan enabled, but the FrameViews of detached frames could be observable
by others as being in a disposed state.

The only way (I know of) to delay the disposal is to have a custom
protector-like RAII object, like what was proposed for as-eager-as-could-be
frame finalization. But perhaps there are other ways to go about it; thoughts?

[sof, 2014/09/28 08:20:32]

Forgot to say -- no tests exercise code paths that rely on there not being a
disposed FrameView upon the return of a call that detached a frame. I don't know
if any of the Frame/FrameView protected uses depend on that not happening; but
it seems like a subtle, extra assumption to add.

+
     m_view = view;
 
     if (m_view && isMainFrame()) {
@@ -437,7 +441,7 @@ void LocalFrame::createView(const IntSize& viewportSize, const Color& background
 
     setView(nullptr);
 
-    RefPtr<FrameView> frameView;
+    RefPtrWillBeRawPtr<FrameView> frameView = nullptr;
     if (isLocalRoot) {
         frameView = FrameView::create(this, viewportSize);