Move the Widget hierarchy to the Oilpan heap.

Source/web/PopupMenuChromium.cpp

Index: Source/web/PopupMenuChromium.cpp
diff --git a/Source/web/PopupMenuChromium.cpp b/Source/web/PopupMenuChromium.cpp
index 053e716d3572d27b36f9dfddafd539f269f46039..5464f24750b0423cae1877649f1fbc9903ceb488 100644
--- a/Source/web/PopupMenuChromium.cpp
+++ b/Source/web/PopupMenuChromium.cpp
@@ -47,10 +47,19 @@ PopupMenuChromium::PopupMenuChromium(LocalFrame& frame, PopupMenuClient* client)
 
 PopupMenuChromium::~PopupMenuChromium()
 {
+#if !ENABLE(OILPAN)
     // When the PopupMenuChromium is destroyed, the client could already have been deleted.
     if (m_popup)
         m_popup->disconnectClient();
     hide();

[haraken, 2014/09/26 09:19:25]

Help me understand: Where are disconnectClient and hide() called in oilpan
builds?

[sof, 2014/09/28 17:03:52]

Thanks, I didn't follow through on this dtor change. Only hide() needs to be
called, which is now done when the RenderMenuList is destroy()ed (via
disconnectClient().)

The clearing of the 'client' is not really needed, but to keep it regular, it's
also done w/ Oilpan.

+#endif
+}
+
+void PopupMenuChromium::trace(Visitor* visitor)
+{
+    visitor->trace(m_frameView);
+    visitor->trace(m_popup);
+    PopupMenu::trace(visitor);
 }
 
 void PopupMenuChromium::show(const FloatQuad& controlPosition, const IntSize& controlSize, int index)