Move Frame to the Oilpan heap.

Source/core/dom/Document.cpp

Index: Source/core/dom/Document.cpp
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
index 866bdeda65440203d03980fc24b8636800b622c3..6d9f8f1ce59d71eb193ac50747af0833d23cd8f8 100644
--- a/Source/core/dom/Document.cpp
+++ b/Source/core/dom/Document.cpp
@@ -115,6 +115,7 @@
 #include "core/frame/EventHandlerRegistry.h"
 #include "core/frame/FrameConsole.h"
 #include "core/frame/FrameHost.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/History.h"
 #include "core/frame/LocalDOMWindow.h"
@@ -1808,7 +1809,7 @@ void Document::updateRenderTree(StyleRecalcChange change)
     // Script can run below in WidgetUpdates, so protect the LocalFrame.
     // FIXME: Can this still happen? How does script run inside
     // UpdateSuspendScope::performDeferredWidgetTreeOperations() ?
-    RefPtr<LocalFrame> protect(m_frame);
+    FrameProtector protect(m_frame);
 
     TRACE_EVENT_BEGIN0("blink", "Document::updateRenderTree");
     TRACE_EVENT_SCOPED_SAMPLING_STATE("blink", "UpdateRenderTree");
@@ -1939,7 +1940,8 @@ void Document::updateLayout()
 
     ScriptForbiddenScope forbidScript;
 
-    RefPtr<FrameView> frameView = view();
+    FrameView* frameView = view();
+    FrameViewProtector protect(frameView);
     if (frameView && frameView->isInPerformLayout()) {
         // View layout should not be re-entrant.
         ASSERT_NOT_REACHED();
@@ -4658,12 +4660,12 @@ void Document::finishedParsing()
     // Keep it alive until we are done.
     RefPtrWillBeRawPtr<Document> protect(this);
 
-    if (RefPtr<LocalFrame> f = frame()) {
+    if (LocalFrame* frame = this->frame()) {
+        FrameProtector protect(frame);
         // Don't update the render tree if we haven't requested the main resource yet to avoid
         // adding extra latency. Note that the first render tree update can be expensive since it
         // triggers the parsing of the default stylesheets which are compiled-in.
-        const bool mainResourceWasAlreadyRequested =
-            m_frame->loader().stateMachine()->committedFirstRealDocumentLoad();
+        const bool mainResourceWasAlreadyRequested = frame->loader().stateMachine()->committedFirstRealDocumentLoad();
 
         // FrameLoader::finishedParsing() might end up calling Document::implicitClose() if all
         // resource loads are complete. HTMLObjectElements can start loading their resources from
@@ -4675,11 +4677,11 @@ void Document::finishedParsing()
         if (mainResourceWasAlreadyRequested)
             updateRenderTreeIfNeeded();
 
-        f->loader().finishedParsing();
+        frame->loader().finishedParsing();
 
-        TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "MarkDOMContent", "data", InspectorMarkLoadEvent::data(f.get()));
+        TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "MarkDOMContent", "data", InspectorMarkLoadEvent::data(frame));
         // FIXME(361045): remove InspectorInstrumentation calls once DevTools Timeline migrates to tracing.
-        InspectorInstrumentation::domContentLoadedEventFired(f.get());
+        InspectorInstrumentation::domContentLoadedEventFired(frame);
     }
 
     // Schedule dropping of the ElementDataCache. We keep it alive for a while after parsing finishes