Prerender need to be on the Oilpan heap.

third_party/WebKit/Source/platform/Prerender.h

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 15 matching lines @@
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  */
 
 #ifndef Prerender_h
 #define Prerender_h
 
 #include "platform/PlatformExport.h"
+#include "platform/heap/Handle.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/Referrer.h"
 #include "wtf/OwnPtr.h"
-#include "wtf/PassOwnPtr.h"
 #include "wtf/PassRefPtr.h"
-#include "wtf/RefCounted.h"
 #include "wtf/RefPtr.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 class PrerenderClient;
 
-class PLATFORM_EXPORT Prerender : public RefCounted<Prerender> {
+class PLATFORM_EXPORT Prerender final : public GarbageCollectedFinalized<Prerender> {
     WTF_MAKE_NONCOPYABLE(Prerender);
 public:
     class ExtraData : public RefCounted<ExtraData> {
     public:
         virtual ~ExtraData() { }
     };
 
-    static PassRefPtr<Prerender> create(PrerenderClient*, const KURL&, unsigned relTypes, const Referrer&);
+    static Prerender* create(PrerenderClient* client, const KURL& url, unsigned relTypes, const Referrer& referrer)
+    {
+        return new Prerender(client, url, relTypes, referrer);
+    }
+
     ~Prerender();
+    DECLARE_TRACE();
 
-    void removeClient();
+    void dispose();
 
     void add();
     void cancel();
     void abandon();
 
     const KURL& url() const { return m_url; }
     unsigned relTypes() const { return m_relTypes; }
     const String& referrer() const { return m_referrer.referrer; }
     ReferrerPolicy getReferrerPolicy() const { return m_referrer.referrerPolicy; }
 
     void setExtraData(PassRefPtr<ExtraData> extraData) { m_extraData = extraData; }
     ExtraData* getExtraData() { return m_extraData.get(); }
 
     void didStartPrerender();
     void didStopPrerender();
     void didSendLoadForPrerender();
     void didSendDOMContentLoadedForPrerender();
 
 private:
     Prerender(PrerenderClient*, const KURL&, unsigned relTypes, const Referrer&);
 
-    PrerenderClient* m_client;
+    Member<PrerenderClient> m_client;
 
     const KURL m_url;
     const unsigned m_relTypes;
     const Referrer m_referrer;
 
     RefPtr<ExtraData> m_extraData;
 };
 
 } // namespace blink
 
 #endif // Prerender_h