Move Frame to the Oilpan heap.

Source/core/editing/DOMSelection.cpp

Index: Source/core/editing/DOMSelection.cpp
diff --git a/Source/core/editing/DOMSelection.cpp b/Source/core/editing/DOMSelection.cpp
index e9de3eac0331e95a360bf9623cf5f945eb5c3b2f..d4eaa607884304371ecd154f480bf656ea4e36e6 100644
--- a/Source/core/editing/DOMSelection.cpp
+++ b/Source/core/editing/DOMSelection.cpp
@@ -557,4 +557,10 @@ void DOMSelection::addConsoleError(const String& message)
         m_treeScope->document().addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
 }
 
+void DOMSelection::trace(Visitor* visitor)
+{
+    visitor->trace(m_treeScope);
+    DOMWindowProperty::trace(visitor);
+}
+
 } // namespace blink