Move color chooser objects to the Oilpan heap.

Source/web/ColorChooserUIController.cpp

Index: Source/web/ColorChooserUIController.cpp
diff --git a/Source/web/ColorChooserUIController.cpp b/Source/web/ColorChooserUIController.cpp
index e456781cfd077914a471cc157ea260409516c739..fef7eee867bddf4deae66c619b3d0e85227e7de5 100644
--- a/Source/web/ColorChooserUIController.cpp
+++ b/Source/web/ColorChooserUIController.cpp
@@ -38,13 +38,23 @@ namespace blink {
 
 
 ColorChooserUIController::ColorChooserUIController(LocalFrame* frame, ColorChooserClient* client)
-    : m_frame(frame)
-    , m_client(client)
+    : m_client(client)
+    , m_frame(frame)
 {
 }
 
 ColorChooserUIController::~ColorChooserUIController()
 {
+    // The client cannot be accessed when finalizing.
+    m_client = nullptr;
+    endChooser();
+}
+
+void ColorChooserUIController::trace(Visitor* visitor)
+{
+    visitor->trace(m_frame);
+    visitor->trace(m_client);
+    ColorChooser::trace(visitor);
 }
 
 void ColorChooserUIController::openUI()
@@ -79,7 +89,8 @@ void ColorChooserUIController::didEndChooser()
 {
     ASSERT(m_client);

[haraken, 2014/10/07 08:27:35]

I think you need to remove this ASSERT.

[sof, 2014/10/08 10:26:34]

Done.

     m_chooser = nullptr;
-    m_client->didEndChooser();
+    if (m_client)
+        m_client->didEndChooser();
 }
 
 void ColorChooserUIController::openColorChooser()