[vm] frame dealloc clears pagedir first