Move Frame to the Oilpan heap.

Source/core/dom/Element.cpp

Index: Source/core/dom/Element.cpp
diff --git a/Source/core/dom/Element.cpp b/Source/core/dom/Element.cpp
index 7f7a9a06ab6a6cc3ac920dbf1a2572a23eb3d8a8..66a86fa50fea0502b6af8248bae681e5402fad47 100644
--- a/Source/core/dom/Element.cpp
+++ b/Source/core/dom/Element.cpp
@@ -75,6 +75,7 @@
 #include "core/editing/markup.h"
 #include "core/events/EventDispatcher.h"
 #include "core/events/FocusEvent.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
@@ -2084,11 +2085,13 @@ void Element::focus(bool restorePreviousSelection, FocusType type)
 void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
 {
     if (isRootEditableElement()) {
-        // Taking the ownership since setSelection() may release the last reference to |frame|.
-        RefPtr<LocalFrame> frame(document().frame());
+        LocalFrame* frame = document().frame();
         if (!frame)
             return;
 
+        // Taking the ownership since setSelection() may release the last reference to |frame|.
+        FrameProtector protect(frame);
+
         // When focusing an editable element in an iframe, don't reset the selection if it already contains a selection.
         if (this == frame->selection().rootEditableElement())
             return;