Move Frame to the Oilpan heap.

Source/core/rendering/RenderLayerScrollableArea.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 31 matching lines @@
  */
 
 #include "config.h"
 #include "core/rendering/RenderLayer.h"
 
 #include "core/accessibility/AXObjectCache.h"
 #include "core/css/PseudoStyleRequest.h"
 #include "core/dom/Node.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/editing/FrameSelection.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "core/page/Chrome.h"
 #include "core/page/EventHandler.h"
 #include "core/page/FocusController.h"
 #include "core/page/Page.h"
 #include "core/page/scrolling/ScrollingCoordinator.h"
@@ skipping 289 matching lines @@
     }
 
     if (scrollOffset() == toIntSize(newScrollOffset))
         return;
 
     setScrollOffset(toIntSize(newScrollOffset));
 
     LocalFrame* frame = box().frame();
     ASSERT(frame);
 
-    RefPtr<FrameView> frameView = box().frameView();
+    FrameView* frameView = box().frameView();
+    FrameViewProtector protect(frameView);
 
     TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "ScrollLayer", "data", InspectorScrollLayerEvent::data(&box()));
     // FIXME(361045): remove InspectorInstrumentation calls once DevTools Timeline migrates to tracing.
     InspectorInstrumentation::willScrollLayer(&box());
 
     const RenderLayerModelObject* paintInvalidationContainer = box().containerForPaintInvalidation();
 
     // Update the positions of our child layers (if needed as only fixed layers should be impacted by a scroll).
     // We don't update compositing layers, because we need to do a deep update from the compositing ancestor.
     if (!frameView->isInPerformLayout()) {
@@ skipping 1101 matching lines @@
 void RenderLayerScrollableArea::setTopmostScrollChild(RenderLayer* scrollChild)
 {
     // We only want to track the topmost scroll child for scrollable areas with
     // overlay scrollbars.
     if (!hasOverlayScrollbars())
         return;
     m_nextTopmostScrollChild = scrollChild;
 }
 
 } // namespace blink