Move Frame to the Oilpan heap.

Source/core/frame/Frame.h

Index: Source/core/frame/Frame.h
diff --git a/Source/core/frame/Frame.h b/Source/core/frame/Frame.h
index 498cb77c81bfd740d26d1fdc0c02b6131f656796..9d1a9cfd18b6385109fafc82a6aacdc7872ded59 100644
--- a/Source/core/frame/Frame.h
+++ b/Source/core/frame/Frame.h
@@ -34,28 +34,30 @@
 #include "wtf/RefCounted.h"
 
 namespace blink {
-class WebLayer;
-}
-
-namespace blink {
 
 class ChromeClient;
 class FrameClient;
 class FrameHost;
 class FrameOwner;
+class FrameProtector;
 class HTMLFrameOwnerElement;
 class LocalDOMWindow;
 class Page;
 class RenderPart;
 class Settings;
+class WebLayer;
 
-class Frame : public RefCounted<Frame> {
+class Frame : public RefCountedWillBeGarbageCollectedFinalized<Frame> {
 public:
     virtual bool isLocalFrame() const { return false; }
     virtual bool isRemoteFrame() const { return false; }
 
     virtual ~Frame();
+    virtual void trace(Visitor*);
 
+#if ENABLE(OILPAN)
+    void willBeDestroyed();
+#endif
     virtual void detach() = 0;
     void detachChildren();
 
@@ -87,8 +89,8 @@ public:
     RenderPart* ownerRenderer() const; // Renderer for the element that contains this frame.
 
     // FIXME: These should move to RemoteFrame when that is instantiated.
-    void setRemotePlatformLayer(blink::WebLayer*);
-    blink::WebLayer* remotePlatformLayer() const { return m_remotePlatformLayer; }
+    void setRemotePlatformLayer(WebLayer*);
+    WebLayer* remotePlatformLayer() const { return m_remotePlatformLayer; }
 
     Settings* settings() const; // can be null
 
@@ -98,19 +100,49 @@ public:
     // method.
     bool isRemoteFrameTemporary() const { return m_remotePlatformLayer; }
 
+#if ENABLE(OILPAN)
+    bool hasBeenDisposed() const { return m_hasBeenDisposed; }
+
+    int incrementDisposeProtectionCount() { return m_disposeProtectionCount++; }
+    int decrementDisposeProtectionCount() { ASSERT(m_disposeProtectionCount > 0); return --m_disposeProtectionCount; }
+#endif
+
 protected:
     Frame(FrameClient*, FrameHost*, FrameOwner*);
 
+    virtual void dispose();
+
+#if ENABLE(OILPAN)
+    friend class FrameProtector;
+
+    void setHasBeenDisposed() { m_hasBeenDisposed = true; }
+#endif
+
     mutable FrameTree m_treeNode;
 
     FrameHost* m_host;
-    FrameOwner* m_owner;
+    RawPtrWillBeMember<FrameOwner> m_owner;
 
-    RefPtrWillBePersistent<LocalDOMWindow> m_domWindow;
+    RefPtrWillBeMember<LocalDOMWindow> m_domWindow;
 
 private:
     FrameClient* m_client;
-    blink::WebLayer* m_remotePlatformLayer;
+    WebLayer* m_remotePlatformLayer;
+
+#if ENABLE(OILPAN)
+    // If > 0, the LocalFrame has existing stack references and
+    // its disposing should be delayed until the stack has unwound
+    // past all of them. The FrameProtector class handles
+    // the details.
+    int m_disposeProtectionCount;
+
+    // The flag will be set to true when the frame is informed of
+    // pending destruction. All Frame owners must explicitly signal
+    // this (through Frame::willBeDestroyed()) so that timely
+    // finalization actions can be performed then; this cannot be
+    // reliably done when the GCed object is later on swept.
+    bool m_hasBeenDisposed;
+#endif
 };
 
 inline FrameClient* Frame::client() const