Move Frame to the Oilpan heap.

Source/core/loader/DocumentWriter.cpp

Index: Source/core/loader/DocumentWriter.cpp
diff --git a/Source/core/loader/DocumentWriter.cpp b/Source/core/loader/DocumentWriter.cpp
index 6aa5acbd902aa8b41f36508709a207b0b7843341..dd2763d4fba6d8272dc42e576350c875cc798e25 100644
--- a/Source/core/loader/DocumentWriter.cpp
+++ b/Source/core/loader/DocumentWriter.cpp
@@ -31,13 +31,14 @@
 
 #include "core/dom/Document.h"
 #include "core/dom/ScriptableDocumentParser.h"
-#include "core/html/parser/TextResourceDecoder.h"
-#include "core/loader/FrameLoader.h"
-#include "core/loader/FrameLoaderStateMachine.h"
-#include "core/frame/LocalDOMWindow.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/FrameView.h"
+#include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
+#include "core/html/parser/TextResourceDecoder.h"
+#include "core/loader/FrameLoader.h"
+#include "core/loader/FrameLoaderStateMachine.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "wtf/PassOwnPtr.h"
@@ -106,7 +107,7 @@ void DocumentWriter::end()
     // http://bugs.webkit.org/show_bug.cgi?id=10854
     // The frame's last ref may be removed and it can be deleted by checkCompleted(),
     // so we'll add a protective refcount
-    RefPtr<LocalFrame> protector(m_document->frame());
+    FrameProtector protect(m_document->frame());
 
     if (!m_parser)
         return;