Move Frame to the Oilpan heap.

Source/core/rendering/RenderMenuList.cpp

 /*
  * This file is part of the select element renderer in WebCore.
  *
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *               2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 63 matching lines @@
     if (m_popup)
         m_popup->disconnectClient();
     m_popup = nullptr;
     RenderFlexibleBox::destroy();
 }
 
 void RenderMenuList::trace(Visitor* visitor)
 {
     visitor->trace(m_buttonText);
     visitor->trace(m_innerBlock);
+    visitor->trace(m_popup);
     RenderFlexibleBox::trace(visitor);
 }
 
 // FIXME: Instead of this hack we should add a ShadowRoot to <select> with no insertion point
 // to prevent children from rendering.
 bool RenderMenuList::isChildAllowed(RenderObject* object, RenderStyle*) const
 {
     return object->isAnonymous() && !object->isRenderFullScreen();
 }
 
@@ skipping 524 matching lines @@
     HTMLElement* element = listItems[listIndex];
     return isHTMLOptionElement(*element) && toHTMLOptionElement(*element).selected();
 }
 
 void RenderMenuList::setTextFromItem(unsigned listIndex)
 {
     setTextFromOption(selectElement()->listToOptionIndex(listIndex));
 }
 
 } // namespace blink