Move Frame to the Oilpan heap.

Source/core/frame/Frame.h

Index: Source/core/frame/Frame.h
diff --git a/Source/core/frame/Frame.h b/Source/core/frame/Frame.h
index 498cb77c81bfd740d26d1fdc0c02b6131f656796..827ad38279964a119a5f7532c47196345f2edbcc 100644
--- a/Source/core/frame/Frame.h
+++ b/Source/core/frame/Frame.h
@@ -34,10 +34,6 @@
 #include "wtf/RefCounted.h"
 
 namespace blink {
-class WebLayer;
-}
-
-namespace blink {
 
 class ChromeClient;
 class FrameClient;
@@ -48,13 +44,15 @@ class LocalDOMWindow;
 class Page;
 class RenderPart;
 class Settings;
+class WebLayer;
 
-class Frame : public RefCounted<Frame> {
+class Frame : public RefCountedWillBeGarbageCollectedFinalized<Frame> {
 public:
     virtual bool isLocalFrame() const { return false; }
     virtual bool isRemoteFrame() const { return false; }
 
     virtual ~Frame();
+    virtual void trace(Visitor*);
 
     virtual void detach() = 0;
     void detachChildren();
@@ -87,8 +85,8 @@ public:
     RenderPart* ownerRenderer() const; // Renderer for the element that contains this frame.
 
     // FIXME: These should move to RemoteFrame when that is instantiated.
-    void setRemotePlatformLayer(blink::WebLayer*);
-    blink::WebLayer* remotePlatformLayer() const { return m_remotePlatformLayer; }
+    void setRemotePlatformLayer(WebLayer*);
+    WebLayer* remotePlatformLayer() const { return m_remotePlatformLayer; }
 
     Settings* settings() const; // can be null
 
@@ -98,19 +96,31 @@ public:
     // method.
     bool isRemoteFrameTemporary() const { return m_remotePlatformLayer; }
 
+    bool hasBeenClosed() const { return m_hasBeenClosed; }
+    void setHasBeenClosed() { ASSERT(!m_hasBeenClosed); m_hasBeenClosed = true; }
+
 protected:
     Frame(FrameClient*, FrameHost*, FrameOwner*);
 
     mutable FrameTree m_treeNode;
 
-    FrameHost* m_host;
-    FrameOwner* m_owner;
+    RawPtrWillBeMember<FrameHost> m_host;
+    RawPtrWillBeMember<FrameOwner> m_owner;
 
-    RefPtrWillBePersistent<LocalDOMWindow> m_domWindow;
+    RefPtrWillBeMember<LocalDOMWindow> m_domWindow;
 
 private:
     FrameClient* m_client;
-    blink::WebLayer* m_remotePlatformLayer;
+    WebLayer* m_remotePlatformLayer;
+
+    // The closing of a frame from the embedder may not trigger the
+    // immediate release of this Frame object -- there might be
+    // other RefPtrs to the Frame, up the stack or elsewhere. For Oilpan,
+    // any release will only happen at the next GC.
+    //
+    // Hence, keep a separate flag that's set when the frame is
+    // closed. It is consulted by window.closed.
+    bool m_hasBeenClosed;
 };
 
 inline FrameClient* Frame::client() const