Move Frame to the Oilpan heap.

Source/core/editing/FrameSelection.cpp

Index: Source/core/editing/FrameSelection.cpp
diff --git a/Source/core/editing/FrameSelection.cpp b/Source/core/editing/FrameSelection.cpp
index c5a52c7bd274220b44d26b2febe1d483a7281b6e..f64f52963ccdd04748ef04b2c1824f6fd0ef8e18 100644
--- a/Source/core/editing/FrameSelection.cpp
+++ b/Source/core/editing/FrameSelection.cpp
@@ -237,12 +237,16 @@ void FrameSelection::setSelection(const VisibleSelection& newSelection, SetSelec
     if (s.base().anchorNode()) {
         Document& document = *s.base().document();
         if (document.frame() && document.frame() != m_frame && document != m_frame->document()) {
-            RefPtr<LocalFrame> guard = document.frame();
+            RefPtrWillBeRawPtr<LocalFrame> guard(document.frame());
             document.frame()->selection().setSelection(s, options, align, granularity);
             // It's possible that during the above set selection, this FrameSelection has been modified by
             // selectFrameElementInParentIfFullySelected, but that the selection is no longer valid since
             // the frame is about to be destroyed. If this is the case, clear our selection.
+#if ENABLE(OILPAN)
+            if (guard->hasBeenClosed() && !m_selection.isNonOrphanedCaretOrRange())
+#else
             if (guard->hasOneRef() && !m_selection.isNonOrphanedCaretOrRange())

[haraken, 2014/09/08 07:25:57]

Would it be possible to use guard->hasBeenClosed() in non-oilpan builds as well?
(To make it workable, we'll need to enable the close call in non-oilpan builds.)

We don't want to have different call paths between oilpan builds and non-oilpan
builds as much as possible.

[sof, 2014/09/11 13:27:05]

Overloooked previously; now done.

+#endif
                 clear();
             return;
         }
@@ -1174,9 +1178,8 @@ void FrameSelection::prepareForDestruction()
 
     m_caretBlinkTimer.stop();
 
-    RenderView* view = m_frame->contentRenderer();
-    if (view)
-        view->clearSelection();
+    if (FrameView* view = m_frame->view())
+        view->clear();

[haraken, 2014/09/08 07:25:57]

What is this change for?

[sof, 2014/09/08 21:17:45]

It does not belong here; reverted.

 
     setSelection(VisibleSelection(), CloseTyping | ClearTypingStyle | DoNotUpdateAppearance);
     m_previousCaretNode.clear();
@@ -1898,6 +1901,7 @@ void FrameSelection::showTreeForThis() const
 
 void FrameSelection::trace(Visitor* visitor)
 {
+    visitor->trace(m_frame);
     visitor->trace(m_selection);
     visitor->trace(m_originalBase);
     visitor->trace(m_logicalRange);