Move Frame to the Oilpan heap.

Source/core/frame/FrameProtector.h

Index: Source/core/frame/FrameProtector.h
diff --git a/Source/core/frame/FrameProtector.h b/Source/core/frame/FrameProtector.h
new file mode 100644
index 0000000000000000000000000000000000000000..b4be8c64032147856446dbb26bf51ff8e3cca481
--- /dev/null
+++ b/Source/core/frame/FrameProtector.h
@@ -0,0 +1,55 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef FrameProtector_h
+#define FrameProtector_h
+
+#include "platform/heap/Handle.h"
+
+namespace blink {
+
+class Frame;
+class FrameView;
+
+class FrameProtector {

[Mads Ager (chromium), 2014/09/03 10:07:54]

Let's add a comment to FrameProtector stating that disposal of a Frame is
delayed until there are no more FrameProtectors for that frame?

+    DISALLOW_ALLOCATION();
+public:
+    explicit FrameProtector(PassRefPtrWillBeRawPtr<Frame>);
+    ~FrameProtector();
+
+    bool willDispose() const;
+
+    void trace(Visitor*);

[Mads Ager (chromium), 2014/09/03 10:07:54]

Trace is unimplemented? It is not used because FrameProtector is in fact always
STACK_ALLOCATED, but we should implement it? We might be able to extend the
STACK_ALLOCATED check in the plugin to state that a STACK_ALLOCATED class can be
a part object in other STACK_ALLOCATED objects. (I can't remember if we do
something like that already? This cannot be marked as STACK_ALLOCATED now,
right?)

[zerny-chromium, 2014/09/03 12:35:08]

A stack allocated object may have parts that are and pointers to stack allocated
things. If you can't get it past the plugin file a bug and I'll get it fixed
asap

[sof, 2014/09/03 14:28:28]

It was an oversight not to add a trace() implementation - FrameProtector was
initially STACK_ALLOCATED() - when moving to DISALLOW_ALLOCATION(). Will fix.

+
+private:
+    RefPtrWillBeMember<Frame> m_frame;
+#if ENABLE(OILPAN)
+    bool m_isActive;
+#endif
+};
+
+class FrameViewProtector {
+    STACK_ALLOCATED();
+public:
+    explicit FrameViewProtector(PassRefPtr<FrameView>);
+    ~FrameViewProtector();
+
+    bool willDelete() const;
+
+private:
+    RefPtr<FrameView> m_frameView;
+#if ENABLE(OILPAN)
+    // With Oilpan, keep a protector for the FrameView' LocalFrame.
+    // This is to trigger any disposing of that frame which should
+    // happen when the FrameViewProtector goes out of scope.
+    //
+    // The RefPtr<LocalFrame> achieves this as it is non-Oilpan,
+    // so no need to keep an additional protector.
+    FrameProtector m_frameProtector;
+#endif
+};
+
+} // namespace blink
+
+#endif // FrameProtector_h