Move Frame to the Oilpan heap.

Source/core/page/EventHandler.cpp

Index: Source/core/page/EventHandler.cpp
diff --git a/Source/core/page/EventHandler.cpp b/Source/core/page/EventHandler.cpp
index 21ed824b1a70e8a6b4251948d86f695876461802..0c60a35eda054995c20ee6abc8226036e040faf3 100644
--- a/Source/core/page/EventHandler.cpp
+++ b/Source/core/page/EventHandler.cpp
@@ -244,6 +244,7 @@ void EventHandler::trace(Visitor* visitor)
     visitor->trace(m_capturingMouseEventsNode);
     visitor->trace(m_nodeUnderMouse);
     visitor->trace(m_lastNodeUnderMouse);
+    visitor->trace(m_lastMouseMoveEventSubframe);
     visitor->trace(m_clickNode);
     visitor->trace(m_dragTarget);
     visitor->trace(m_frameSetBeingResized);
@@ -1238,7 +1239,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_mousePressNode = mev.innerNode();
 
-    RefPtr<LocalFrame> subframe = subframeForHitTestResult(mev);
+    RefPtrWillBeRawPtr<LocalFrame> subframe = subframeForHitTestResult(mev);
     if (subframe && passMousePressEventToSubframe(mev, subframe.get())) {
         // Start capturing future events for this frame.  We only do this if we didn't clear
         // the m_mousePressed flag, which may happen if an AppKit widget entered a modal event loop.
@@ -1444,7 +1445,7 @@ bool EventHandler::handleMouseMoveOrLeaveEvent(const PlatformMouseEvent& mouseEv
     }
 
     bool swallowEvent = false;
-    RefPtr<LocalFrame> newSubframe = m_capturingMouseEventsNode.get() ? subframeForTargetNode(m_capturingMouseEventsNode.get()) : subframeForHitTestResult(mev);
+    RefPtrWillBeRawPtr<LocalFrame> newSubframe = m_capturingMouseEventsNode.get() ? subframeForTargetNode(m_capturingMouseEventsNode.get()) : subframeForHitTestResult(mev);
 
     // We want mouseouts to happen first, from the inside out.  First send a move event to the last subframe so that it will fire mouseouts.
     if (m_lastMouseMoveEventSubframe && m_lastMouseMoveEventSubframe->tree().isDescendantOf(m_frame) && m_lastMouseMoveEventSubframe != newSubframe)
@@ -2080,8 +2081,9 @@ bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
     GestureEventWithHitTestResults targetedEvent = targetGestureEvent(gestureEvent);
 
     // Route to the correct frame.
-    if (LocalFrame* innerFrame = targetedEvent.hitTestResult().innerNodeFrame())
+    if (LocalFrame* innerFrame = targetedEvent.hitTestResult().innerNodeFrame()) {

[Mads Ager (chromium), 2014/09/16 12:17:45]

Left-over edit from debugging? :)

[sof, 2014/09/17 09:42:58]

Spot on :)

         return innerFrame->eventHandler().handleGestureEventInFrame(targetedEvent);
+    }
 
     // No hit test result, handle in root instance. Perhaps we should just return false instead?
     return handleGestureEventInFrame(targetedEvent);
@@ -2202,6 +2204,7 @@ bool EventHandler::handleGestureScrollEvent(const PlatformGestureEvent& gestureE
 bool EventHandler::handleGestureTap(const GestureEventWithHitTestResults& targetedEvent)
 {
     RefPtr<FrameView> protector(m_frame->view());
+
     const PlatformGestureEvent& gestureEvent = targetedEvent.event();
     HitTestRequest::HitTestRequestType hitType = getHitTypeForGestureType(gestureEvent.type());
 
@@ -2296,6 +2299,7 @@ bool EventHandler::handleGestureLongPress(const GestureEventWithHitTestResults&
         dragState().m_dragSrc = nullptr;
         m_mouseDownPos = m_frame->view()->windowToContents(mouseDragEvent.position());
         RefPtr<FrameView> protector(m_frame->view());
+
         handleDrag(mev, DontCheckDragHysteresis);
         if (m_didStartDrag) {
             m_longTapShouldInvokeContextMenu = true;