Prerender need to be on the Oilpan heap.

third_party/WebKit/Source/platform/Prerender.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 19 matching lines @@
  */
 
 #include "platform/Prerender.h"
 
 #include "platform/PrerenderClient.h"
 #include "public/platform/WebPrerender.h"
 #include "public/platform/WebPrerenderingSupport.h"
 
 namespace blink {
 
-PassRefPtr<Prerender> Prerender::create(PrerenderClient* client, const KURL& url, unsigned relTypes, const Referrer& referrer)
-{
-    return adoptRef(new Prerender(client, url, relTypes, referrer));
-}
-
 Prerender::Prerender(PrerenderClient* client, const KURL& url, const unsigned relTypes, const Referrer& referrer)
     : m_client(client)
     , m_url(url)
     , m_relTypes(relTypes)
     , m_referrer(referrer)
 {
 }
 
 Prerender::~Prerender()
 {
 }
 
-void Prerender::removeClient()
+DEFINE_TRACE(Prerender)
 {
-    m_client = 0;
+    visitor->trace(m_client);
+}
+
+void Prerender::dispose()
+{
+    m_client = nullptr;
+    m_extraData.clear();
 }
 
 void Prerender::add()
 {
     if (WebPrerenderingSupport* platform = WebPrerenderingSupport::current())
         platform->add(WebPrerender(this));
 }
 
 void Prerender::cancel()
 {
@@ skipping 25 matching lines @@
         m_client->didSendLoadForPrerender();
 }
 
 void Prerender::didSendDOMContentLoadedForPrerender()
 {
     if (m_client)
         m_client->didSendDOMContentLoadedForPrerender();
 }
 
 } // namespace blink