Move Frame to the Oilpan heap.

Source/web/WebFrame.cpp

Index: Source/web/WebFrame.cpp
diff --git a/Source/web/WebFrame.cpp b/Source/web/WebFrame.cpp
index 7fbdac76057e344dda465878c00fb1a4cde75209..826f69d06bb99574a13a752590594315a9d81917 100644
--- a/Source/web/WebFrame.cpp
+++ b/Source/web/WebFrame.cpp
@@ -8,6 +8,7 @@
 #include "core/frame/RemoteFrame.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "platform/UserGestureIndicator.h"
+#include "platform/heap/Handle.h"
 #include "web/OpenedFrameTracker.h"
 #include "web/WebLocalFrameImpl.h"
 #include "web/WebRemoteFrameImpl.h"
@@ -28,7 +29,7 @@ Frame* toCoreFrame(const WebFrame* frame)
 bool WebFrame::swap(WebFrame* frame)
 {
     using std::swap;
-    RefPtr<Frame> oldFrame = toCoreFrame(this);
+    RefPtrWillBeRawPtr<Frame> oldFrame = toCoreFrame(this);
 
     // All child frames must be detached first.
     oldFrame->detachChildren();
@@ -230,4 +231,20 @@ WebFrame::~WebFrame()
     m_openedFrameTracker.reset(0);
 }
 
+void WebFrame::traceChildren(Visitor* visitor, WebFrame* frame)

[Mads Ager (chromium), 2014/09/18 12:00:59]

It is probably a good idea to continue to trace the children this way to be
completely safe. With the self-persistents it is probably not strictly
necessary, but with conservative stack scanning in the picture it is nice to be
sure that all the children are kept alive if we find one of the nodes.

[sof, 2014/09/18 13:31:15]

Very good point, I hadn't realized the implication here of that self-sustaining
change. Hmm, fine either way, but tracing errs on the side of caution, so let's
keep it.

+{
+#if ENABLE(OILPAN)
+    // Trace the children frames.
+    WebFrame* child = frame ? frame->firstChild() : 0;
+    while (child) {
+        if (child->isWebLocalFrame())
+            visitor->trace(toWebLocalFrameImpl(child));
+        else
+            visitor->trace(toWebRemoteFrameImpl(child));
+
+        child = child->nextSibling();
+    }
+#endif
+}
+
 } // namespace blink