Move Frame to the Oilpan heap.

Source/core/frame/LocalDOMWindow.cpp

Index: Source/core/frame/LocalDOMWindow.cpp
diff --git a/Source/core/frame/LocalDOMWindow.cpp b/Source/core/frame/LocalDOMWindow.cpp
index 54eee0b21640a0177e665dc83cbf1aeaf6420452..028abf90ac49cf87c702742c444d86426a65bf91 100644
--- a/Source/core/frame/LocalDOMWindow.cpp
+++ b/Source/core/frame/LocalDOMWindow.cpp
@@ -62,6 +62,7 @@
 #include "core/frame/EventHandlerRegistry.h"
 #include "core/frame/FrameConsole.h"
 #include "core/frame/FrameHost.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/History.h"
 #include "core/frame/LocalFrame.h"
@@ -1073,7 +1074,7 @@ bool LocalDOMWindow::find(const String& string, bool caseSensitive, bool backwar
 
     // |m_frame| can be destructed during |Editor::findString()| via
     // |Document::updateLayou()|, e.g. event handler removes a frame.
-    RefPtr<LocalFrame> protectFrame(m_frame);
+    FrameProtector protectFrame(m_frame);
 
     // FIXME (13016): Support wholeWord, searchInFrames and showDialog
     return m_frame->editor().findString(string, !backwards, caseSensitive, wrap, false);
@@ -1396,7 +1397,8 @@ void LocalDOMWindow::scrollTo(int x, int y, ScrollBehavior scrollBehavior) const
 
     document()->updateLayoutIgnorePendingStylesheets();
 
-    RefPtr<FrameView> view = m_frame->view();
+    FrameView* view = m_frame->view();
+    FrameViewProtector protect(view);
     if (!view)
         return;