Move Frame to the Oilpan heap.

Source/core/frame/FrameView.cpp

Index: Source/core/frame/FrameView.cpp
diff --git a/Source/core/frame/FrameView.cpp b/Source/core/frame/FrameView.cpp
index 5d42bdac25b2d6c954d44fa2973ecd91db2e3f19..17910484b84aa01021e77a42b8d316e77d716a92 100644
--- a/Source/core/frame/FrameView.cpp
+++ b/Source/core/frame/FrameView.cpp
@@ -37,6 +37,7 @@
 #include "core/fetch/ResourceFetcher.h"
 #include "core/fetch/ResourceLoadPriorityOptimizer.h"
 #include "core/frame/FrameHost.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/html/HTMLFrameElement.h"
@@ -668,7 +669,8 @@ inline void FrameView::forceLayoutParentViewIfNeeded()
     // FrameView for a layout. After that the RenderEmbeddedObject (ownerRenderer) carries the
     // correct size, which RenderSVGRoot::computeReplacedLogicalWidth/Height rely on, when laying
     // out for the first time, or when the RenderSVGRoot size has changed dynamically (eg. via <script>).
-    RefPtr<FrameView> frameView = ownerRenderer->frame()->view();
+    FrameView* frameView = ownerRenderer->frame()->view();
+    FrameViewProtector protect(frameView);
 
     // Mark the owner renderer as needing layout.
     ownerRenderer->setNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation();
@@ -779,7 +781,7 @@ void FrameView::layout(bool allowSubtree)
     TRACE_EVENT_SCOPED_SAMPLING_STATE("blink", "Layout");
 
     // Protect the view from being deleted during layout (in recalcStyle)
-    RefPtr<FrameView> protector(this);
+    FrameViewProtector protector(this);
 
     // Every scroll that happens during layout is programmatic.
     TemporaryChange<bool> changeInProgrammaticScroll(m_inProgrammaticScroll, true);
@@ -803,7 +805,7 @@ void FrameView::layout(bool allowSubtree)
 
     // If there is only one ref to this view left, then its going to be destroyed as soon as we exit,
     // so there's no point to continuing to layout
-    if (protector->hasOneRef())
+    if (protector.willDelete())
         return;
 
     Document* document = m_frame->document();
@@ -1512,7 +1514,7 @@ void FrameView::updateLayersAndCompositingAfterScrollIfNeeded()
     if (!hasViewportConstrainedObjects())
         return;
 
-    RefPtr<FrameView> protect(this);
+    FrameViewProtector protect(this);
 
     // If there fixed position elements, scrolling may cause compositing layers to change.
     // Update widget and layer positions after scrolling, but only if we're not inside of
@@ -1879,7 +1881,7 @@ bool FrameView::updateWidgets()
 void FrameView::updateWidgetsTimerFired(Timer<FrameView>*)
 {
     ASSERT(!isInPerformLayout());
-    RefPtr<FrameView> protect(this);
+    FrameViewProtector protect(this);
     m_updateWidgetsTimer.stop();
     for (unsigned i = 0; i < maxUpdateWidgetsIterations; ++i) {
         if (updateWidgets())
@@ -1912,7 +1914,7 @@ void FrameView::performPostLayoutTasks()
     // We should ASSERT(isActive()); or at least return early if we can!
     ASSERT(!isInPerformLayout()); // Always before or after performLayout(), part of the highest-level layout() call.
     TRACE_EVENT0("blink", "FrameView::performPostLayoutTasks");
-    RefPtr<FrameView> protect(this);
+    FrameViewProtector protect(this);
 
     m_postLayoutTasksTimer.stop();
 
@@ -2537,7 +2539,7 @@ void FrameView::updateWidgetPositionsIfNeeded()
 void FrameView::updateLayoutAndStyleForPainting()
 {
     // Updating layout can run script, which can tear down the FrameView.
-    RefPtr<FrameView> protector(this);
+    FrameViewProtector protect(this);
 
     updateLayoutAndStyleIfNeededRecursive();