Move Frame to the Oilpan heap.

Source/core/loader/NavigationScheduler.cpp

Index: Source/core/loader/NavigationScheduler.cpp
diff --git a/Source/core/loader/NavigationScheduler.cpp b/Source/core/loader/NavigationScheduler.cpp
index 53211a9e063450e28acd0eda902345cbdc043602..13e2a8fccaee31a5b4d9ee9b219b1399a5e2d1c6 100644
--- a/Source/core/loader/NavigationScheduler.cpp
+++ b/Source/core/loader/NavigationScheduler.cpp
@@ -372,7 +372,7 @@ void NavigationScheduler::timerFired(Timer<NavigationScheduler>*)
         return;
     }
 
-    RefPtr<LocalFrame> protect(m_frame);
+    RefPtrWillBeRawPtr<LocalFrame> protect(m_frame.get());
 
     OwnPtr<ScheduledNavigation> redirect(m_redirect.release());
     redirect->fire(m_frame);
@@ -388,7 +388,7 @@ void NavigationScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
     // and/or confuse the JS when it shortly thereafter tries to schedule a location change. Let the JS have its way.
     // FIXME: This check seems out of place.
     if (!m_frame->loader().stateMachine()->committedFirstRealDocumentLoad() && m_frame->loader().provisionalDocumentLoader()) {
-        RefPtr<Frame> protect(m_frame);
+        RefPtrWillBeRawPtr<LocalFrame> protect(m_frame.get());
         m_frame->loader().provisionalDocumentLoader()->stopLoading();
         if (!m_frame->host())
             return;
@@ -422,4 +422,9 @@ void NavigationScheduler::cancel()
     m_redirect.clear();
 }
 
+void NavigationScheduler::trace(Visitor* visitor)
+{
+    visitor->trace(m_frame);
+}
+
 } // namespace blink