Move color chooser objects to the Oilpan heap.

Source/web/ColorChooserUIController.cpp

Index: Source/web/ColorChooserUIController.cpp
diff --git a/Source/web/ColorChooserUIController.cpp b/Source/web/ColorChooserUIController.cpp
index e456781cfd077914a471cc157ea260409516c739..874918455b22d237021a349d1c8b183f3b100a5f 100644
--- a/Source/web/ColorChooserUIController.cpp
+++ b/Source/web/ColorChooserUIController.cpp
@@ -45,6 +45,16 @@ ColorChooserUIController::ColorChooserUIController(LocalFrame* frame, ColorChoos
 
 ColorChooserUIController::~ColorChooserUIController()
 {
+    // The client cannot be accessed when finalizing.
+    m_client = nullptr;
+    endChooser();
+}
+
+void ColorChooserUIController::trace(Visitor* visitor)
+{
+    visitor->trace(m_frame);
+    visitor->trace(m_client);
+    ColorChooser::trace(visitor);
 }
 
 void ColorChooserUIController::openUI()
@@ -79,7 +89,8 @@ void ColorChooserUIController::didEndChooser()
 {
     ASSERT(m_client);
     m_chooser = nullptr;
-    m_client->didEndChooser();
+    if (m_client)
+        m_client->didEndChooser();
 }
 
 void ColorChooserUIController::openColorChooser()