Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
index 03aed594ebe1ccbb56e744bf9fdb46ce227b05d7..f2a50965cb56c90e9053189173815547399d28ba 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
@@ -646,16 +646,12 @@ void HTMLCanvasElement::toBlob(BlobCallback* callback, const String& mimeType, c
     ImageData* imageData = toImageData(BackBuffer, SnapshotReasonToBlob);
     // imageData unref its data, which we still keep alive for the async toBlob thread
     ScopedDisposal<ImageData> disposer(imageData);
-    // Add a ref to keep image data alive until completion of encoding
-    RefPtr<DOMUint8ClampedArray> imageDataRef(imageData->data());
+    CanvasAsyncBlobCreator* asyncCreator = CanvasAsyncBlobCreator::create(imageData->data(), encodingMimeType, imageData->size(), callback);
 
-    RefPtr<CanvasAsyncBlobCreator> asyncCreatorRef = CanvasAsyncBlobCreator::create(imageDataRef.release(), encodingMimeType, imageData->size(), callback);
-
-    if (encodingMimeType == DefaultMimeType) {
-        asyncCreatorRef->scheduleAsyncBlobCreation(true);
-    } else {
-        asyncCreatorRef->scheduleAsyncBlobCreation(false, quality);
-    }
+    if (encodingMimeType == DefaultMimeType)
+        asyncCreator->scheduleAsyncBlobCreation(true);
+    else
+        asyncCreator->scheduleAsyncBlobCreation(false, quality);
 }
 
 void HTMLCanvasElement::addListener(CanvasDrawListener* listener)