Move Frame to the Oilpan heap.

Source/core/loader/ProgressTracker.h

Index: Source/core/loader/ProgressTracker.h
diff --git a/Source/core/loader/ProgressTracker.h b/Source/core/loader/ProgressTracker.h
index 5e7188fa8885bec9cfbf4e0338c398988a41aa73..ead18ffa18172d49208880b5a659fb023509693f 100644
--- a/Source/core/loader/ProgressTracker.h
+++ b/Source/core/loader/ProgressTracker.h
@@ -66,6 +66,14 @@ private:
 
     void reset();
 
+    // This bare frame pointer is safe; it refers to the
+    // owning frame (via FrameLoader.)
+    //
+    // ProgressTracker is finalized by FrameLoader (which in turn is
+    // finalized by LocalFrame.) Its lifetime thus guarantees that
+    // m_frame cannot be used to access a dead LocalFrame.
+    //
+    // FIXME: Oilpan: tidy up and move ProgressTracker to the heap.
     LocalFrame* m_frame;
     bool m_inProgress;
     long long m_totalPageAndResourceBytesToLoad;