Move Frame to the Oilpan heap.

Source/core/loader/ProgressTracker.h

Index: Source/core/loader/ProgressTracker.h
diff --git a/Source/core/loader/ProgressTracker.h b/Source/core/loader/ProgressTracker.h
index 5e7188fa8885bec9cfbf4e0338c398988a41aa73..d3dcd2cfffaed91dba26f59f8b0ee6510dd4c847 100644
--- a/Source/core/loader/ProgressTracker.h
+++ b/Source/core/loader/ProgressTracker.h
@@ -66,6 +66,12 @@ private:
 
     void reset();
 
+    // This bare frame pointer is safe; it refers to the

[Mads Ager (chromium), 2014/09/18 12:00:59]

Are there finalization order issues with moving ProgressTracker to the heap and
tracing the local frame pointer? I agree that this is a safe raw pointer and
that we can postpone more work on this until this patch has successfully landed.
:)

[sof, 2014/09/18 13:31:15]

Yes, that was where I landed in the end -- there are no issues, I did this in
patchset #36 but thought it could wait, hence backed it out.

+    // owning frame (via FrameLoader.)
+    //
+    // ProgressTracker is finalized by FrameLoader (which in turn is
+    // finalized by LocalFrame.) Its lifetime thus guarantees that
+    // m_frame cannot be used to access a dead LocalFrame.
     LocalFrame* m_frame;
     bool m_inProgress;
     long long m_totalPageAndResourceBytesToLoad;