I found that RenderLayer still uses raw pointers to the objects which it owns. Looks like these pointers could be replaced with OwnPtrs. Patch to follow.
Created attachment 175790 [details] Patch
Comment on attachment 175790 [details] Patch Yay!
Committed r135605: <http://trac.webkit.org/changeset/135605>