Prerender need to be on the Oilpan heap.

third_party/WebKit/Source/core/loader/PrerenderHandle.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 30 matching lines @@
 namespace blink {
 
 // static
 PrerenderHandle* PrerenderHandle::create(Document& document, PrerenderClient* client, const KURL& url, const unsigned prerenderRelTypes)
 {
     // Prerenders are unlike requests in most ways (for instance, they pass down fragments, and they don't return data),
     // but they do have referrers.
     if (!document.frame())
         return nullptr;
 
-    RefPtr<Prerender> prerender = Prerender::create(client, url, prerenderRelTypes, SecurityPolicy::generateReferrer(document.getReferrerPolicy(), url, document.outgoingReferrer()));
+    Prerender* prerender = Prerender::create(client, url, prerenderRelTypes, SecurityPolicy::generateReferrer(document.getReferrerPolicy(), url, document.outgoingReferrer()));
 
     PrerendererClient* prerendererClient = PrerendererClient::from(document.page());
     if (prerendererClient)
-        prerendererClient->willAddPrerender(prerender.get());
+        prerendererClient->willAddPrerender(prerender);
     prerender->add();
 
-    return new PrerenderHandle(document, prerender.release());
+    return new PrerenderHandle(document, prerender);
 }
 
-PrerenderHandle::PrerenderHandle(Document& document, PassRefPtr<Prerender> prerender)
+PrerenderHandle::PrerenderHandle(Document& document, Prerender* prerender)
     : DocumentLifecycleObserver(&document)
     , m_prerender(prerender)
 {
 }
 
 PrerenderHandle::~PrerenderHandle()
 {
     if (m_prerender)
         detach();

[haraken, 2016/04/07 00:08:12]

Now you cannot touch m_prerender in the destructor?

[sof, 2016/04/07 05:12:13]

Like for other eagerly finalized objects, you can touch objects in other lazy,
sub heaps (or arenas, to use the current term/naming.)

 }
 
 void PrerenderHandle::cancel()
 {
     // Avoid both abandoning and canceling the same prerender. In the abandon case, the LinkLoader cancels the
     // PrerenderHandle as the Document is destroyed, even through the DocumentLifecycleObserver has already abandoned
     // it.
     if (!m_prerender)
         return;
     m_prerender->cancel();
@@ skipping 13 matching lines @@
     // that is already canceled (and thus detached). In that case,
     // we should not detach the PrerenderHandle again, so we need this check.
     if (!m_prerender)
         return;
     m_prerender->abandon();
     detach();
 }
 
 void PrerenderHandle::detach()
 {
-    m_prerender->removeClient();
+    m_prerender->dispose();
     m_prerender.clear();
 }
 
 DEFINE_TRACE(PrerenderHandle)
 {
+    visitor->trace(m_prerender);
     DocumentLifecycleObserver::trace(visitor);
 }
 
 } // namespace blink