Move Frame to the Oilpan heap.

Source/core/xml/parser/XMLDocumentParser.cpp

 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 989 matching lines @@
     }
 
     newElement->beginParsingChildren();
 
     ScriptLoader* scriptLoader = toScriptLoaderIfPossible(newElement.get());
     if (scriptLoader)
         m_scriptStartPosition = textPosition();
 
     m_currentNode->parserAppendChild(newElement.get());
 
+    // Event handlers may synchronously trigger removal of the
+    // document and cancellation of this parser.

[haraken, 2014/09/22 05:35:23]

Just help me understand: What's the relationship between this change and moving
Frame to the heap?

[sof, 2014/09/22 07:47:43]

The frame might now be detached as a result of sync'ly running some event
handlers during the append operation above, making this parser advance to a
stopped state.

This didn't happen before. Well, it still won't non-Oilpan, but always
performing this extra check made sense. We similarly check across a number of
other tree operations in XMLDocumentParser.

+    if (isStopped()) {
+        stopParsing();
+        return;
+    }
+
     if (isHTMLTemplateElement(*newElement))
         pushCurrentNode(toHTMLTemplateElement(*newElement).content());
     else
         pushCurrentNode(newElement.get());
 
     if (isHTMLHtmlElement(*newElement))
         toHTMLHtmlElement(*newElement).insertedByParser();
 
     if (!m_parsingFragment && isFirstElement && document()->frame())
         document()->frame()->loader().dispatchDocumentElementAvailable();
@@ skipping 617 matching lines @@
     sax.initialized = XML_SAX2_MAGIC;
     RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
     parseChunk(parser->context(), parseString);
     finishParsing(parser->context());
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
 
 } // namespace blink