Prerender need to be on the Oilpan heap.

third_party/WebKit/Source/core/loader/PrerenderHandle.cpp

Index: third_party/WebKit/Source/core/loader/PrerenderHandle.cpp
diff --git a/third_party/WebKit/Source/core/loader/PrerenderHandle.cpp b/third_party/WebKit/Source/core/loader/PrerenderHandle.cpp
index 9efd6f9c05bbcdeb8b826b04227fcdbb809af4a6..33c5ccbc658547a2bf05247ca12b0505c731dffc 100644
--- a/third_party/WebKit/Source/core/loader/PrerenderHandle.cpp
+++ b/third_party/WebKit/Source/core/loader/PrerenderHandle.cpp
@@ -48,17 +48,17 @@ PrerenderHandle* PrerenderHandle::create(Document& document, PrerenderClient* cl
     if (!document.frame())
         return nullptr;
 
-    RefPtr<Prerender> prerender = Prerender::create(client, url, prerenderRelTypes, SecurityPolicy::generateReferrer(document.getReferrerPolicy(), url, document.outgoingReferrer()));
+    Prerender* prerender = Prerender::create(client, url, prerenderRelTypes, SecurityPolicy::generateReferrer(document.getReferrerPolicy(), url, document.outgoingReferrer()));
 
     PrerendererClient* prerendererClient = PrerendererClient::from(document.page());
     if (prerendererClient)
-        prerendererClient->willAddPrerender(prerender.get());
+        prerendererClient->willAddPrerender(prerender);
     prerender->add();
 
-    return new PrerenderHandle(document, prerender.release());
+    return new PrerenderHandle(document, prerender);
 }
 
-PrerenderHandle::PrerenderHandle(Document& document, PassRefPtr<Prerender> prerender)
+PrerenderHandle::PrerenderHandle(Document& document, Prerender* prerender)
     : DocumentLifecycleObserver(&document)
     , m_prerender(prerender)
 {
@@ -101,12 +101,13 @@ void PrerenderHandle::documentWasDetached()
 
 void PrerenderHandle::detach()
 {
-    m_prerender->removeClient();
+    m_prerender->dispose();
     m_prerender.clear();
 }
 
 DEFINE_TRACE(PrerenderHandle)
 {
+    visitor->trace(m_prerender);
     DocumentLifecycleObserver::trace(visitor);
 }