Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/dom/DOMTypedArray.cpp

Index: third_party/WebKit/Source/core/dom/DOMTypedArray.cpp
diff --git a/third_party/WebKit/Source/core/dom/DOMTypedArray.cpp b/third_party/WebKit/Source/core/dom/DOMTypedArray.cpp
index 109808a9eaf32496d1ed73f18c65593dc0f9c163..edc6f268415293d054f0d002c4b0d29dbded2e90 100644
--- a/third_party/WebKit/Source/core/dom/DOMTypedArray.cpp
+++ b/third_party/WebKit/Source/core/dom/DOMTypedArray.cpp
@@ -21,16 +21,11 @@ namespace blink {
 template<typename WTFTypedArray, typename V8TypedArray>
 v8::Local<v8::Object> DOMTypedArray<WTFTypedArray, V8TypedArray>::wrap(v8::Isolate* isolate, v8::Local<v8::Object> creationContext)
 {
-    // It's possible that no one except for the new wrapper owns this object at
-    // this moment, so we have to prevent GC to collect this object until the
-    // object gets associated with the wrapper.
-    RefPtr<ThisType> protect(this);
-
     DCHECK(!DOMDataStore::containsWrapper(this, isolate));
 
     const WrapperTypeInfo* wrapperTypeInfo = this->wrapperTypeInfo();
-    RefPtr<DOMArrayBufferBase> buffer = this->bufferBase();
-    v8::Local<v8::Value> v8Buffer = toV8(buffer.get(), creationContext, isolate);
+    DOMArrayBufferBase* buffer = this->bufferBase();
+    v8::Local<v8::Value> v8Buffer = toV8(buffer, creationContext, isolate);
     if (v8Buffer.IsEmpty())
         return v8::Local<v8::Object>();
     DCHECK_EQ(isShared(), v8Buffer->IsSharedArrayBuffer());