Move Frame to the Oilpan heap.

Source/web/PopupMenuChromium.cpp

 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 30 matching lines @@
 
 PopupMenuChromium::PopupMenuChromium(LocalFrame& frame, PopupMenuClient* client)
     : m_popupClient(client)
     , m_frameView(frame.view())
 {
 }
 
 PopupMenuChromium::~PopupMenuChromium()
 {
     // When the PopupMenuChromium is destroyed, the client could already have been deleted.
-    if (m_popup)
+    if (m_popup) {
         m_popup->listBox()->disconnectClient();
-    hide();
+        m_popup->hide();
+    }
 }
 
 void PopupMenuChromium::show(const FloatQuad& controlPosition, const IntSize& controlSize, int index)
 {
     if (!m_popup) {
         bool deviceSupportsTouch = m_frameView->frame().settings()->deviceSupportsTouch();
         m_popup = PopupContainer::create(m_popupClient, deviceSupportsTouch);
     }
     m_popup->showInRect(controlPosition, controlSize, m_frameView.get(), index);
 }
 
 void PopupMenuChromium::hide()
 {
     if (m_popup)
         m_popup->hide();
 }
 
 void PopupMenuChromium::updateFromElement()
 {
     m_popup->listBox()->updateFromElement();
 }
 
 
 void PopupMenuChromium::disconnectClient()
 {
     m_popupClient = 0;
+    hide();
+    m_popup.clear();

[haraken, 2014/09/08 07:25:59]

What is this change for?

[sof, 2014/09/08 21:17:46]

The hiding during disconnect isn't separately needed provided the PopupContainer
handles the FrameHost-detached LocalFrame condition, which I think there's no
way around (now.) So, I've reverted the earlier triggering of hiding here -
sorry about the noise/mess.

 }
 
 } // namespace blink