Move the Widget hierarchy to the Oilpan heap.

Source/core/rendering/RenderScrollbar.h

Index: Source/core/rendering/RenderScrollbar.h
diff --git a/Source/core/rendering/RenderScrollbar.h b/Source/core/rendering/RenderScrollbar.h
index 99b609bed51aafdb3095a4649eb83c571a65b3a5..b55b30f018adcae3056f8d8af92ce2e73fa4f7bf 100644
--- a/Source/core/rendering/RenderScrollbar.h
+++ b/Source/core/rendering/RenderScrollbar.h
@@ -44,7 +44,7 @@ protected:
 
 public:
     friend class Scrollbar;
-    static PassRefPtr<Scrollbar> createCustomScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame* owningFrame = 0);
+    static PassRefPtrWillBeRawPtr<Scrollbar> createCustomScrollbar(ScrollableArea*, ScrollbarOrientation, Node*, LocalFrame* owningFrame = 0);
     virtual ~RenderScrollbar();
 
     RenderBox* owningRenderer() const;
@@ -59,6 +59,8 @@ public:
 
     virtual bool isOverlayScrollbar() const OVERRIDE { return false; }
 
+    virtual void trace(Visitor*) OVERRIDE;
+
 private:
     virtual void setParent(Widget*) OVERRIDE;
     virtual void setEnabled(bool) OVERRIDE;
@@ -79,9 +81,18 @@ private:
     // so we keep a reference to the Node which caused this custom scrollbar creation.
     // This will not create a reference cycle as the Widget tree is owned by our containing
     // FrameView which this Node pointer can in no way keep alive. See webkit bug 80610.
-    RefPtrWillBePersistent<Node> m_owner;
-
-    LocalFrame* m_owningFrame;
+    RefPtrWillBeMember<Node> m_owner;
+
+    RawPtrWillBeMember<LocalFrame> m_owningFrame;
+
+    // FIXME: Oilpan: post-detach creation of RenderScrollbarPart
+    // objects (see ~RenderScrollbar comment) makes it difficult to
+    // ensure that all RenderScrollbarParts have been explicitly
+    // destroyed prior to finalization. To reliably address, a
+    // Persistent reference to the hash map is kept here, so that the
+    // RenderScrollbar finalizer can safely notify the 'parts' of
+    // destruction..before they're swept out the next time around.
+    GC_PLUGIN_IGNORE("")
     WillBePersistentHeapHashMap<unsigned, RawPtrWillBeMember<RenderScrollbarPart> > m_parts;

[haraken, 2014/09/26 09:19:25]

Can we use a disposer pattern to delay the finalization of the
RenderScrollbarPart objects?

  PersistentHeapHashMap<WeakMember<RenderScrollbar>,
OwnPtr<RenderScrollbarDisposer>>;


You can destruct RenderScrollbarPart objects in the destructor of
RenderScrollbarDisposer.

[sof, 2014/09/28 21:11:25]

That map would have to be global, right? RenderScrollbarPart is also on the
heap, so you presumably would have to generalize to something like

  PersistentHeapHashMap<WeakMember<RenderScrollbar>,
Member<RenderScrollbarPartSet>>

where RenderScrollbarPartSet would be

class RenderScrollbarPartSet : public GarbageCollected<..> {
 ...
 private:
     HeapHashSet<unsigned, Member<RenderScrollbarPart>> m_parts;
};

and then have a weak callback on the HeapHashMap (via a wrapper object that's
also on the heap & what the Persistent<> above holds onto. That weak callback
would then do the needed disposal of the RenderScrollbarPartSet.

An indirect arrangement, but it would save having a per RenderScrollbar
persistent. Does it have other merits?

[sof, 2014/10/07 15:30:37]

Used a pre-finalizer to handle this instead; no Persistent needed, I hope.

 };