Prerender need to be on the Oilpan heap.

third_party/WebKit/Source/platform/Prerender.cpp

Index: third_party/WebKit/Source/platform/Prerender.cpp
diff --git a/third_party/WebKit/Source/platform/Prerender.cpp b/third_party/WebKit/Source/platform/Prerender.cpp
index 203d620332732381922232927446da8cdea1bfc2..3e47c44c54528509f195260834e1f35430b1f7b0 100644
--- a/third_party/WebKit/Source/platform/Prerender.cpp
+++ b/third_party/WebKit/Source/platform/Prerender.cpp
@@ -37,11 +37,6 @@
 
 namespace blink {
 
-PassRefPtr<Prerender> Prerender::create(PrerenderClient* client, const KURL& url, unsigned relTypes, const Referrer& referrer)
-{
-    return adoptRef(new Prerender(client, url, relTypes, referrer));
-}
-
 Prerender::Prerender(PrerenderClient* client, const KURL& url, const unsigned relTypes, const Referrer& referrer)
     : m_client(client)
     , m_url(url)
@@ -54,9 +49,15 @@ Prerender::~Prerender()
 {
 }
 
-void Prerender::removeClient()
+DEFINE_TRACE(Prerender)
+{
+    visitor->trace(m_client);
+}
+
+void Prerender::dispose()
 {
-    m_client = 0;
+    m_client = nullptr;
+    m_extraData.clear();
 }
 
 void Prerender::add()