Move Frame to the Oilpan heap.

Source/web/PopupMenuChromium.cpp

Index: Source/web/PopupMenuChromium.cpp
diff --git a/Source/web/PopupMenuChromium.cpp b/Source/web/PopupMenuChromium.cpp
index 05561cc4b52489b0654998853f4d2528065ca70b..2462b44e0f78b2e4360da3616cb4e3cf183e9f7c 100644
--- a/Source/web/PopupMenuChromium.cpp
+++ b/Source/web/PopupMenuChromium.cpp
@@ -48,9 +48,10 @@ PopupMenuChromium::PopupMenuChromium(LocalFrame& frame, PopupMenuClient* client)
 PopupMenuChromium::~PopupMenuChromium()
 {
     // When the PopupMenuChromium is destroyed, the client could already have been deleted.
-    if (m_popup)
+    if (m_popup) {
         m_popup->listBox()->disconnectClient();
-    hide();
+        m_popup->hide();
+    }
 }
 
 void PopupMenuChromium::show(const FloatQuad& controlPosition, const IntSize& controlSize, int index)
@@ -77,6 +78,8 @@ void PopupMenuChromium::updateFromElement()
 void PopupMenuChromium::disconnectClient()
 {
     m_popupClient = 0;
+    hide();
+    m_popup.clear();
 }
 
 } // namespace blink