Move Frame to the Oilpan heap.

Source/bindings/core/v8/custom/V8HTMLDocumentCustom.cpp

Index: Source/bindings/core/v8/custom/V8HTMLDocumentCustom.cpp
diff --git a/Source/bindings/core/v8/custom/V8HTMLDocumentCustom.cpp b/Source/bindings/core/v8/custom/V8HTMLDocumentCustom.cpp
index 6cd24b9791f9f304e0906eca6b21f27651180e2a..6491a980040f9fad2aa59eea0abd95c9a58776b8 100644
--- a/Source/bindings/core/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/Source/bindings/core/v8/custom/V8HTMLDocumentCustom.cpp
@@ -38,6 +38,7 @@
 #include "bindings/core/v8/V8Node.h"
 #include "bindings/core/v8/V8Window.h"
 #include "core/HTMLNames.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/LocalFrame.h"
 #include "core/html/HTMLAllCollection.h"
 #include "core/html/HTMLCollection.h"
@@ -56,9 +57,10 @@ void V8HTMLDocument::openMethodCustom(const v8::FunctionCallbackInfo<v8::Value>&
     HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder());
 
     if (info.Length() > 2) {
-        if (RefPtr<LocalFrame> frame = htmlDocument->frame()) {
+        if (LocalFrame* frame = htmlDocument->frame()) {
+            FrameProtector protect(frame);
             // Fetch the global object for the frame.
-            v8::Local<v8::Context> context = toV8Context(frame.get(), DOMWrapperWorld::current(info.GetIsolate()));
+            v8::Local<v8::Context> context = toV8Context(frame, DOMWrapperWorld::current(info.GetIsolate()));
             // Bail out if we cannot get the context.
             if (context.IsEmpty())
                 return;