Move Frame to the Oilpan heap.

Source/web/WebPluginContainerImpl.h

Index: Source/web/WebPluginContainerImpl.h
diff --git a/Source/web/WebPluginContainerImpl.h b/Source/web/WebPluginContainerImpl.h
index 206c9178c7a0533257fc974dd3db3507c3dadd67..5ff3dcaf5a794f24ed46f98530be968f5bdd365e 100644
--- a/Source/web/WebPluginContainerImpl.h
+++ b/Source/web/WebPluginContainerImpl.h
@@ -63,7 +63,13 @@ class WheelEvent;
 class Widget;
 struct WebPrintParams;
 
-class WebPluginContainerImpl FINAL : public PluginView, public WebPluginContainer, public FrameDestructionObserver {
+class WebPluginContainerImpl FINAL
+    : public PluginView
+    , public WebPluginContainer
+#if !ENABLE(OILPAN)
+    , public FrameDestructionObserver
+#endif
+    {
 public:
     static PassRefPtr<WebPluginContainerImpl> create(HTMLPlugInElement* element, WebPlugin* webPlugin)
     {
@@ -192,9 +198,24 @@ private:
         const IntRect& frameRect,
         Vector<IntRect>& cutOutRects);
 
-    // FIXME: Oilpan: consider moving Widget to the heap and turn this
-    // into a traced member. For the time being, it is a bare pointer
-    // of its owning PlugInElement and managed as such.
+#if ENABLE(OILPAN)
+    // FIXME: Oilpan: consider moving Widget to the heap, allowing this
+    // container object to be a FrameDestructionObserver. And thereby
+    // keep a traced member reference to the frame rather than as a
+    // bare pointer. Instead, the owning object (HTMLFrameOwnerElement)
+    // explicitly deletes this object when it is disconnected from its
+    // frame. Any access to an invalid frame via this bare pointer
+    // is therefore not possible.
+    //
+    // See the HTMLFrameOwnerElement::disconnectContentFrame comment for
+    // (even) more.
+    LocalFrame* m_frame;
+
+    LocalFrame* frame() const { return m_frame; }
+#endif
+
+    // FIXME: see above; for the time being, a bare pointer to the owning
+    // HTMLPlugInElement and managed as such.
     HTMLPlugInElement* m_element;
     WebPlugin* m_webPlugin;
     Vector<WebPluginLoadObserver*> m_pluginLoadObservers;