Move Frame to the Oilpan heap.

Source/core/rendering/RenderLayerScrollableArea.cpp

Index: Source/core/rendering/RenderLayerScrollableArea.cpp
diff --git a/Source/core/rendering/RenderLayerScrollableArea.cpp b/Source/core/rendering/RenderLayerScrollableArea.cpp
index 20df23b7ae2f22478e4727bd197767d7039116d9..4dbc800d72243474588060e6cad12c2fbb36cacb 100644
--- a/Source/core/rendering/RenderLayerScrollableArea.cpp
+++ b/Source/core/rendering/RenderLayerScrollableArea.cpp
@@ -49,6 +49,7 @@
 #include "core/dom/Node.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/editing/FrameSelection.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/html/HTMLFrameOwnerElement.h"
@@ -358,7 +359,8 @@ void RenderLayerScrollableArea::setScrollOffset(const IntPoint& newScrollOffset)
     LocalFrame* frame = box().frame();
     ASSERT(frame);
 
-    RefPtr<FrameView> frameView = box().frameView();
+    FrameView* frameView = box().frameView();
+    FrameViewProtector protect(frameView);
 
     TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "ScrollLayer", "data", InspectorScrollLayerEvent::data(&box()));
     // FIXME(361045): remove InspectorInstrumentation calls once DevTools Timeline migrates to tracing.