Move Frame to the Oilpan heap.

Source/web/WebFrame.cpp

Index: Source/web/WebFrame.cpp
diff --git a/Source/web/WebFrame.cpp b/Source/web/WebFrame.cpp
index 7fbdac76057e344dda465878c00fb1a4cde75209..826f69d06bb99574a13a752590594315a9d81917 100644
--- a/Source/web/WebFrame.cpp
+++ b/Source/web/WebFrame.cpp
@@ -8,6 +8,7 @@
 #include "core/frame/RemoteFrame.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "platform/UserGestureIndicator.h"
+#include "platform/heap/Handle.h"
 #include "web/OpenedFrameTracker.h"
 #include "web/WebLocalFrameImpl.h"
 #include "web/WebRemoteFrameImpl.h"
@@ -28,7 +29,7 @@ Frame* toCoreFrame(const WebFrame* frame)
 bool WebFrame::swap(WebFrame* frame)
 {
     using std::swap;
-    RefPtr<Frame> oldFrame = toCoreFrame(this);
+    RefPtrWillBeRawPtr<Frame> oldFrame = toCoreFrame(this);
 
     // All child frames must be detached first.
     oldFrame->detachChildren();
@@ -230,4 +231,20 @@ WebFrame::~WebFrame()
     m_openedFrameTracker.reset(0);
 }
 
+void WebFrame::traceChildren(Visitor* visitor, WebFrame* frame)

[haraken, 2014/09/22 05:35:23]

Just to confirm: We just need to trace children and don't need to trace a
parent, right?

As we discussed before, this traceChildren is not needed for correctness because
each Web(Local,Remote)Frame keeps a self-keep-alive persistent handle. Am I
understanding things correctly?

[sof, 2014/09/22 08:26:38]

I'd say so, yes - if we assume that the topmost frame is let go of last, then I
don't see how any parent might be left untraced.
Should we ever reach a state where the self-persistent is released by a Frame,
but the child frame is otherwise still reachable via a frame tree somehow, then
this trace will ensure safety.

If the "safety first" argument feels inconsistent across the two questions asked
here, then let's add a trace of the parent. Or none.

[haraken, 2014/09/22 08:32:55]

Yeah, that's what I wanted to ask :)

If this tracing is needed, it would be more consistent to trace a parent as well
(even though the parent tracing is not needed for some non-trivial reason).
Otherwise, we can just remove the tracing entirely.

[sof, 2014/09/22 09:52:51]

Hmm. I'm going to try to keep this WebFrame tracing around for now; incoming CL
to extend it slightly.

+{
+#if ENABLE(OILPAN)
+    // Trace the children frames.
+    WebFrame* child = frame ? frame->firstChild() : 0;
+    while (child) {
+        if (child->isWebLocalFrame())
+            visitor->trace(toWebLocalFrameImpl(child));
+        else
+            visitor->trace(toWebRemoteFrameImpl(child));
+
+        child = child->nextSibling();
+    }
+#endif
+}
+
 } // namespace blink