Move Frame to the Oilpan heap.

Source/web/PopupMenuChromium.cpp

Index: Source/web/PopupMenuChromium.cpp
diff --git a/Source/web/PopupMenuChromium.cpp b/Source/web/PopupMenuChromium.cpp
index 05561cc4b52489b0654998853f4d2528065ca70b..2462b44e0f78b2e4360da3616cb4e3cf183e9f7c 100644
--- a/Source/web/PopupMenuChromium.cpp
+++ b/Source/web/PopupMenuChromium.cpp
@@ -48,9 +48,10 @@ PopupMenuChromium::PopupMenuChromium(LocalFrame& frame, PopupMenuClient* client)
 PopupMenuChromium::~PopupMenuChromium()
 {
     // When the PopupMenuChromium is destroyed, the client could already have been deleted.
-    if (m_popup)
+    if (m_popup) {
         m_popup->listBox()->disconnectClient();
-    hide();
+        m_popup->hide();
+    }
 }
 
 void PopupMenuChromium::show(const FloatQuad& controlPosition, const IntSize& controlSize, int index)
@@ -77,6 +78,8 @@ void PopupMenuChromium::updateFromElement()
 void PopupMenuChromium::disconnectClient()
 {
     m_popupClient = 0;
+    hide();
+    m_popup.clear();

[haraken, 2014/09/08 07:25:59]

What is this change for?

[sof, 2014/09/08 21:17:46]

The hiding during disconnect isn't separately needed provided the PopupContainer
handles the FrameHost-detached LocalFrame condition, which I think there's no
way around (now.) So, I've reverted the earlier triggering of hiding here -
sorry about the noise/mess.

 }
 
 } // namespace blink