Move Frame to the Oilpan heap.

Source/core/xml/parser/XMLDocumentParser.cpp

Index: Source/core/xml/parser/XMLDocumentParser.cpp
diff --git a/Source/core/xml/parser/XMLDocumentParser.cpp b/Source/core/xml/parser/XMLDocumentParser.cpp
index c53a660612afb98fc957edb2eed1676e70a74a1c..21545a81d4800a3b9498283d90811220890c1c3c 100644
--- a/Source/core/xml/parser/XMLDocumentParser.cpp
+++ b/Source/core/xml/parser/XMLDocumentParser.cpp
@@ -1007,6 +1007,13 @@ void XMLDocumentParser::startElementNs(const AtomicString& localName, const Atom
 
     m_currentNode->parserAppendChild(newElement.get());
 
+    // Event handlers may synchronously trigger removal of the
+    // document and cancellation of this parser.

[haraken, 2014/09/22 05:35:23]

Just help me understand: What's the relationship between this change and moving
Frame to the heap?

[sof, 2014/09/22 07:47:43]

The frame might now be detached as a result of sync'ly running some event
handlers during the append operation above, making this parser advance to a
stopped state.

This didn't happen before. Well, it still won't non-Oilpan, but always
performing this extra check made sense. We similarly check across a number of
other tree operations in XMLDocumentParser.

+    if (isStopped()) {
+        stopParsing();
+        return;
+    }
+
     if (isHTMLTemplateElement(*newElement))
         pushCurrentNode(toHTMLTemplateElement(*newElement).content());
     else