Move Frame to the Oilpan heap.

Source/core/plugins/DOMMimeType.h

 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
     version 2 of the License, or (at your option) any later version.
 
     This library is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 17 matching lines @@
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
 #include "wtf/RefPtr.h"
 
 namespace blink {
 
 class DOMPlugin;
 class LocalFrame;
 
 class DOMMimeType FINAL : public RefCountedWillBeGarbageCollectedFinalized<DOMMimeType>, public ScriptWrappable, public FrameDestructionObserver {
+    WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(DOMMimeType);
     DEFINE_WRAPPERTYPEINFO();
 public:
     static PassRefPtrWillBeRawPtr<DOMMimeType> create(PassRefPtr<PluginData> pluginData, LocalFrame* frame, unsigned index)
     {
         return adoptRefWillBeNoop(new DOMMimeType(pluginData, frame, index));
     }
     virtual ~DOMMimeType();
 
     const String& type() const;
     String suffixes() const;
     const String& description() const;
     PassRefPtrWillBeRawPtr<DOMPlugin> enabledPlugin() const;
 
-    void trace(Visitor*) { }
+    virtual void trace(Visitor*) OVERRIDE;

[haraken, 2014/09/11 14:47:25]

Nit: This is just dispatching a trace method to a parent interface. I don't
think we need this.

[sof, 2014/09/12 12:46:12]

And the presence of a virtual dtor ensures that the leftmost class has a vtable,
but declaring a mixin without a trace()... do we want to do that?

[zerny-chromium, 2014/09/15 06:33:03]

We need to keep the trace here because we want all virtual trace methods to be
located in the "top/left-most" vtbl. Removing this trace definition should
result in a plugin-reported error (for the ToT plugin), but I think there is an
implementation error in the plugin here because the trace method then becomes
inherited.

I'll look at adding some HeapTests and plugin tests to verify the behavior of
this case.

 
 private:
     const MimeClassInfo& mimeClassInfo() const { return m_pluginData->mimes()[m_index]; }
 
     DOMMimeType(PassRefPtr<PluginData>, LocalFrame*, unsigned index);
     RefPtr<PluginData> m_pluginData;
     unsigned m_index;
 };
 
 } // namespace blink
 
 #endif // DOMMimeType_h