Move Frame to the Oilpan heap.

Source/core/frame/Frame.cpp

Index: Source/core/frame/Frame.cpp
diff --git a/Source/core/frame/Frame.cpp b/Source/core/frame/Frame.cpp
index f647b3e5988b5ed202236a17a12183a39112612d..2c8fa28fcbe0341ac0ff9312c7613d9f7eb351dd 100644
--- a/Source/core/frame/Frame.cpp
+++ b/Source/core/frame/Frame.cpp
@@ -63,6 +63,7 @@ Frame::Frame(FrameClient* client, FrameHost* host, FrameOwner* owner)
     , m_owner(owner)
     , m_client(client)
     , m_remotePlatformLayer(0)
+    , m_hasBeenClosed(false)
 {
     ASSERT(page());
 
@@ -81,19 +82,33 @@ Frame::Frame(FrameClient* client, FrameHost* host, FrameOwner* owner)
 
 Frame::~Frame()
 {
+    // FIXME: We should not be doing all this work inside the destructor
+    dispose();

[haraken, 2014/09/11 14:47:25]

What's a benefit of introducing the dispose() method?

Nit: Actually I'm not really a fan of naming a method called inside a destructor
"dispose". "dispose" and "detach" should be called before a destructor gets
called.

[sof, 2014/09/12 12:26:07]

There's no inherent value in keeping this helper, as it has now turned out to be
called always from this destructor (same for LocalFrame::dispose().)

Inlined away.

+}
+
+void Frame::dispose()
+{
+#if !ENABLE(OILPAN)
     disconnectOwnerElement();

[haraken, 2014/09/11 14:47:25]

Who calls this disconnectOwnerElement() in oilpan builds?

[sof, 2014/09/12 12:26:07]

Done when the FrameOwner detaches/disconnects. I think it is guaranteed that
local FrameOwners will always do this. That leaves the non-Local ones - will
have to investigate if some of disconnectOwnerElement() needs to be handled in
other ways for those.

     setDOMWindow(nullptr);
-
-    // FIXME: We should not be doing all this work inside the destructor
+#endif
 
 #ifndef NDEBUG
     frameCounter.decrement();
 #endif
 }
 
+void Frame::trace(Visitor* visitor)
+{
+    visitor->trace(m_treeNode);
+    visitor->trace(m_host);
+    visitor->trace(m_owner);
+    visitor->trace(m_domWindow);
+}
+
 void Frame::detachChildren()
 {
-    typedef Vector<RefPtr<Frame> > FrameVector;
+    typedef WillBeHeapVector<RefPtrWillBeMember<Frame> > FrameVector;
     FrameVector childrenToDetach;
     childrenToDetach.reserveCapacity(tree().childCount());
     for (Frame* child = tree().firstChild(); child; child = child->tree().nextSibling())
@@ -126,6 +141,7 @@ void Frame::setDOMWindow(PassRefPtrWillBeRawPtr<LocalDOMWindow> domWindow)
 {
     if (m_domWindow)
         m_domWindow->reset();
+
     m_domWindow = domWindow;
 }
 
@@ -158,7 +174,7 @@ RenderPart* Frame::ownerRenderer() const
     return toRenderPart(object);
 }
 
-void Frame::setRemotePlatformLayer(blink::WebLayer* layer)
+void Frame::setRemotePlatformLayer(WebLayer* layer)
 {
     if (m_remotePlatformLayer)
         GraphicsLayer::unregisterContentsLayer(m_remotePlatformLayer);
@@ -197,7 +213,7 @@ void Frame::disconnectOwnerElement()
         if (page())
             page()->decrementSubframeCount();
     }
-    m_owner = 0;
+    m_owner = nullptr;
 }
 
 HTMLFrameOwnerElement* Frame::deprecatedLocalOwner() const