Move Frame to the Oilpan heap.

Source/core/xml/parser/XMLDocumentParser.cpp

Index: Source/core/xml/parser/XMLDocumentParser.cpp
diff --git a/Source/core/xml/parser/XMLDocumentParser.cpp b/Source/core/xml/parser/XMLDocumentParser.cpp
index c53a660612afb98fc957edb2eed1676e70a74a1c..21545a81d4800a3b9498283d90811220890c1c3c 100644
--- a/Source/core/xml/parser/XMLDocumentParser.cpp
+++ b/Source/core/xml/parser/XMLDocumentParser.cpp
@@ -1007,6 +1007,13 @@ void XMLDocumentParser::startElementNs(const AtomicString& localName, const Atom
 
     m_currentNode->parserAppendChild(newElement.get());
 
+    // Event handlers may synchronously trigger removal of the
+    // document and cancellation of this parser.
+    if (isStopped()) {
+        stopParsing();
+        return;
+    }
+
     if (isHTMLTemplateElement(*newElement))
         pushCurrentNode(toHTMLTemplateElement(*newElement).content());
     else