Move Frame to the Oilpan heap.

Source/core/plugins/DOMMimeType.h

Index: Source/core/plugins/DOMMimeType.h
diff --git a/Source/core/plugins/DOMMimeType.h b/Source/core/plugins/DOMMimeType.h
index 78518a279a8c482b0410c909223a141d9bfaa9f5..d8b2a7ba3db8c611eea4cf2d2edd7292eb578566 100644
--- a/Source/core/plugins/DOMMimeType.h
+++ b/Source/core/plugins/DOMMimeType.h
@@ -35,6 +35,7 @@ class DOMPlugin;
 class LocalFrame;
 
 class DOMMimeType FINAL : public RefCountedWillBeGarbageCollectedFinalized<DOMMimeType>, public ScriptWrappable, public FrameDestructionObserver {
+    WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(DOMMimeType);
     DEFINE_WRAPPERTYPEINFO();
 public:
     static PassRefPtrWillBeRawPtr<DOMMimeType> create(PassRefPtr<PluginData> pluginData, LocalFrame* frame, unsigned index)
@@ -48,7 +49,7 @@ public:
     const String& description() const;
     PassRefPtrWillBeRawPtr<DOMPlugin> enabledPlugin() const;
 
-    void trace(Visitor*) { }
+    virtual void trace(Visitor*) OVERRIDE;

[haraken, 2014/09/11 14:47:25]

Nit: This is just dispatching a trace method to a parent interface. I don't
think we need this.

[sof, 2014/09/12 12:46:12]

And the presence of a virtual dtor ensures that the leftmost class has a vtable,
but declaring a mixin without a trace()... do we want to do that?

[zerny-chromium, 2014/09/15 06:33:03]

We need to keep the trace here because we want all virtual trace methods to be
located in the "top/left-most" vtbl. Removing this trace definition should
result in a plugin-reported error (for the ToT plugin), but I think there is an
implementation error in the plugin here because the trace method then becomes
inherited.

I'll look at adding some HeapTests and plugin tests to verify the behavior of
this case.

 
 private:
     const MimeClassInfo& mimeClassInfo() const { return m_pluginData->mimes()[m_index]; }