Prerender need to be on the Oilpan heap.

third_party/WebKit/Source/platform/PrerenderClient.h

Index: third_party/WebKit/Source/platform/PrerenderClient.h
diff --git a/third_party/WebKit/Source/platform/PrerenderClient.h b/third_party/WebKit/Source/platform/PrerenderClient.h
index 8b107dc5c974b6893655b556200ba3e94af229e7..34fd6a14d4b14bc30175eafd50ec15b107a3b7a2 100644
--- a/third_party/WebKit/Source/platform/PrerenderClient.h
+++ b/third_party/WebKit/Source/platform/PrerenderClient.h
@@ -33,10 +33,11 @@
 #define PrerenderClient_h
 
 #include "platform/PlatformExport.h"
+#include "platform/heap/Handle.h"
 
 namespace blink {
 
-class PLATFORM_EXPORT PrerenderClient {
+class PLATFORM_EXPORT PrerenderClient : public GarbageCollectedMixin {
 public:
     virtual ~PrerenderClient() { }
 
@@ -44,6 +45,8 @@ public:
     virtual void didStopPrerender() = 0;
     virtual void didSendLoadForPrerender() = 0;
     virtual void didSendDOMContentLoadedForPrerender() = 0;
+
+    DEFINE_INLINE_VIRTUAL_TRACE() { }
 };
 
 } // namespace blink