Have SubframeLoadingDisabler singleton live off-heap.

third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h

 /*
  * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 133 matching lines @@
 
   static bool canLoadFrame(HTMLFrameOwnerElement& owner) {
     for (Node* node = &owner; node; node = node->parentOrShadowHostNode()) {
       if (disabledSubtreeRoots().contains(node))
         return false;
     }
     return true;
   }
 
  private:
-  using SubtreeRootSet = HeapHashCountedSet<Member<Node>>;
+  // The use of UntracedMember<Node>  is safe as all SubtreeRootSet
+  // references are on the stack and reachable in case a conservative
+  // GC hits.
+  // TODO(sof): go back to HeapHashSet<> once crbug.com/684551 has been
+  // resolved.
+  using SubtreeRootSet = HashCountedSet<UntracedMember<Node>>;
 
   CORE_EXPORT static SubtreeRootSet& disabledSubtreeRoots();
 
   Member<Node> m_root;
 };
 
 DEFINE_TYPE_CASTS(HTMLFrameOwnerElement,
                   FrameOwner,
                   owner,
                   owner->isLocal(),
                   owner.isLocal());
 
 }  // namespace blink
 
 #endif  // HTMLFrameOwnerElement_h