Move Frame to the Oilpan heap.

Source/core/loader/NavigationScheduler.cpp

Index: Source/core/loader/NavigationScheduler.cpp
diff --git a/Source/core/loader/NavigationScheduler.cpp b/Source/core/loader/NavigationScheduler.cpp
index 53211a9e063450e28acd0eda902345cbdc043602..7137ea707f60ab8237ef6bb9d825bc7b4ef6060a 100644
--- a/Source/core/loader/NavigationScheduler.cpp
+++ b/Source/core/loader/NavigationScheduler.cpp
@@ -35,6 +35,7 @@
 #include "bindings/core/v8/ScriptController.h"
 #include "core/events/Event.h"
 #include "core/fetch/ResourceLoaderOptions.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/html/HTMLFormElement.h"
@@ -372,7 +373,7 @@ void NavigationScheduler::timerFired(Timer<NavigationScheduler>*)
         return;
     }
 
-    RefPtr<LocalFrame> protect(m_frame);
+    FrameProtector protect(m_frame);
 
     OwnPtr<ScheduledNavigation> redirect(m_redirect.release());
     redirect->fire(m_frame);
@@ -388,7 +389,7 @@ void NavigationScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
     // and/or confuse the JS when it shortly thereafter tries to schedule a location change. Let the JS have its way.
     // FIXME: This check seems out of place.
     if (!m_frame->loader().stateMachine()->committedFirstRealDocumentLoad() && m_frame->loader().provisionalDocumentLoader()) {
-        RefPtr<Frame> protect(m_frame);
+        FrameProtector protect(m_frame.get());
         m_frame->loader().provisionalDocumentLoader()->stopLoading();
         if (!m_frame->host())
             return;
@@ -422,4 +423,9 @@ void NavigationScheduler::cancel()
     m_redirect.clear();
 }
 
+void NavigationScheduler::trace(Visitor* visitor)
+{
+    visitor->trace(m_frame);
+}
+
 } // namespace blink