Move Frame to the Oilpan heap.

Source/core/html/parser/HTMLDocumentParser.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 221 matching lines @@
 
     // We will not have a scriptRunner when parsing a DocumentFragment.
     if (m_scriptRunner)
         document()->setReadyState(Document::Interactive);
 
     // Setting the ready state above can fire mutation event and detach us
     // from underneath. In that case, just bail out.
     if (isDetached())
         return;
 
+#if ENABLE(OILPAN)
+    // The Oilpan sub-variant of the above; the document (parser) may
+    // only have stopped by this stage, but the parser hasn't been cancelled
+    // and detached. With Oilpan, parser cancellation won't happen when
+    // the LocalFrame is finalized. Hence, a stopped parser is the strongest
+    // condition we can test for here. Bail, if so.
+    if (isStopped())
+        return;
+#endif
+
+
     attemptToRunDeferredScriptsAndEnd();
 }
 
 bool HTMLDocumentParser::isParsingFragment() const
 {
     return m_treeBuilder->isParsingFragment();
 }
 
 bool HTMLDocumentParser::processingData() const
 {
@@ skipping 822 matching lines @@
 void HTMLDocumentParser::setDecoder(PassOwnPtr<TextResourceDecoder> decoder)
 {
     ASSERT(decoder);
     DecodedDataDocumentParser::setDecoder(decoder);
 
     if (m_haveBackgroundParser)
         HTMLParserThread::shared()->postTask(bind(&BackgroundHTMLParser::setDecoder, m_backgroundParser, takeDecoder()));
 }
 
 }