Have SubframeLoadingDisabler singleton live off-heap.

third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h

Index: third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h
diff --git a/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h b/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h
index e284c039d0e396b48453d46414ff9d710ec67388..e49a47aaf2ed40e62b148253006d4f8cfec6c393 100644
--- a/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h
@@ -151,7 +151,12 @@ class SubframeLoadingDisabler {
   }
 
  private:
-  using SubtreeRootSet = HeapHashCountedSet<Member<Node>>;
+  // The use of UntracedMember<Node>  is safe as all SubtreeRootSet
+  // references are on the stack and reachable in case a conservative
+  // GC hits.
+  // TODO(sof): go back to HeapHashSet<> once crbug.com/684551 has been
+  // resolved.
+  using SubtreeRootSet = HashCountedSet<UntracedMember<Node>>;
 
   CORE_EXPORT static SubtreeRootSet& disabledSubtreeRoots();