Prerender need to be on the Oilpan heap.

third_party/WebKit/Source/core/loader/PrerenderHandle.h

Index: third_party/WebKit/Source/core/loader/PrerenderHandle.h
diff --git a/third_party/WebKit/Source/core/loader/PrerenderHandle.h b/third_party/WebKit/Source/core/loader/PrerenderHandle.h
index 97a7392acd3a000ebb3680efeafafc05ac7cb283..f57d647e1f4d6eaf7cc969703a424f612e682990 100644
--- a/third_party/WebKit/Source/core/loader/PrerenderHandle.h
+++ b/third_party/WebKit/Source/core/loader/PrerenderHandle.h
@@ -59,13 +59,14 @@ public:
     void documentWasDetached() override;
 
     DECLARE_VIRTUAL_TRACE();
+    EAGERLY_FINALIZE();
 
 private:
-    PrerenderHandle(Document&, PassRefPtr<Prerender>);
+    PrerenderHandle(Document&, Prerender*);
 
     void detach();
 
-    RefPtr<Prerender> m_prerender;
+    Member<Prerender> m_prerender;
 };
 
 } // namespace blink