Move Frame to the Oilpan heap.

Source/bindings/core/v8/custom/V8HTMLDocumentCustom.cpp

 /*
  * Copyright (C) 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 20 matching lines @@
 #include "config.h"
 #include "bindings/core/v8/V8HTMLDocument.h"
 
 #include "bindings/core/v8/ScriptController.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8HTMLAllCollection.h"
 #include "bindings/core/v8/V8HTMLCollection.h"
 #include "bindings/core/v8/V8Node.h"
 #include "bindings/core/v8/V8Window.h"
 #include "core/HTMLNames.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/LocalFrame.h"
 #include "core/html/HTMLAllCollection.h"
 #include "core/html/HTMLCollection.h"
 #include "core/html/HTMLDocument.h"
 #include "core/html/HTMLIFrameElement.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/RefPtr.h"
 #include "wtf/StdLibExtras.h"
 
 namespace blink {
 
 // HTMLDocument ----------------------------------------------------------------
 
 void V8HTMLDocument::openMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder());
 
     if (info.Length() > 2) {
-        if (RefPtr<LocalFrame> frame = htmlDocument->frame()) {
+        if (LocalFrame* frame = htmlDocument->frame()) {
+            FrameProtector protect(frame);
             // Fetch the global object for the frame.
-            v8::Local<v8::Context> context = toV8Context(frame.get(), DOMWrapperWorld::current(info.GetIsolate()));
+            v8::Local<v8::Context> context = toV8Context(frame, DOMWrapperWorld::current(info.GetIsolate()));
             // Bail out if we cannot get the context.
             if (context.IsEmpty())
                 return;
             v8::Local<v8::Object> global = context->Global();
             // Get the open property of the global object.
             v8::Local<v8::Value> function = global->Get(v8AtomicString(info.GetIsolate(), "open"));
             // Failed; return without throwing (new) exception.
             if (function.IsEmpty())
                 return;
             // If the open property is not a function throw a type error.
@@ skipping 13 matching lines @@
 
     ExceptionState exceptionState(ExceptionState::ExecutionContext, "open", "Document", info.Holder(), info.GetIsolate());
     htmlDocument->open(callingDOMWindow(info.GetIsolate())->document(), exceptionState);
     if (exceptionState.throwIfNeeded())
         return;
 
     v8SetReturnValue(info, info.Holder());
 }
 
 } // namespace blink