Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTCharacteristic.cpp

Index: third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTCharacteristic.cpp
diff --git a/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTCharacteristic.cpp b/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTCharacteristic.cpp
index 1a34791f59f73b7a196bf1effd58fcdae30d60d6..7d76e5dcc1e0dd1a7c516dcc41b3b92523bd8c48 100644
--- a/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTCharacteristic.cpp
+++ b/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTCharacteristic.cpp
@@ -20,13 +20,11 @@ namespace blink {
 
 namespace {
 
-PassRefPtr<DOMDataView> ConvertWebVectorToDataView(
-    const WebVector<uint8_t>& webVector)
+DOMDataView* ConvertWebVectorToDataView(const WebVector<uint8_t>& webVector)
 {
     static_assert(sizeof(*webVector.data()) == 1, "uint8_t should be a single byte");
-    RefPtr<DOMArrayBuffer> domBuffer = DOMArrayBuffer::create(webVector.data(), webVector.size());
-    RefPtr<DOMDataView> domDataView = DOMDataView::create(domBuffer, 0, webVector.size());
-    return domDataView;
+    DOMArrayBuffer* domBuffer = DOMArrayBuffer::create(webVector.data(), webVector.size());
+    return DOMDataView::create(domBuffer, 0, webVector.size());
 }
 
 } // anonymous namespace
@@ -52,8 +50,7 @@ BluetoothRemoteGATTCharacteristic* BluetoothRemoteGATTCharacteristic::take(Scrip
     return characteristic;
 }
 
-void BluetoothRemoteGATTCharacteristic::setValue(
-    const PassRefPtr<DOMDataView>& domDataView)
+void BluetoothRemoteGATTCharacteristic::setValue(DOMDataView* domDataView)
 {
     m_value = domDataView;
 }
@@ -61,8 +58,7 @@ void BluetoothRemoteGATTCharacteristic::setValue(
 void BluetoothRemoteGATTCharacteristic::dispatchCharacteristicValueChanged(
     const WebVector<uint8_t>& value)
 {
-    RefPtr<DOMDataView> domDataView = ConvertWebVectorToDataView(value);
-    this->setValue(domDataView);
+    this->setValue(ConvertWebVectorToDataView(value));
     dispatchEvent(Event::create(EventTypeNames::characteristicvaluechanged));
 }
 
@@ -115,10 +111,10 @@ public:
         if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
             return;
 
-        RefPtr<DOMDataView> domDataView = ConvertWebVectorToDataView(value);
-        if (m_webCharacteristic) {
+        DOMDataView* domDataView = ConvertWebVectorToDataView(value);
+        if (m_webCharacteristic)
             m_webCharacteristic->setValue(domDataView);
-        }
+
         m_resolver->resolve(domDataView);

[ortuno, 2016/04/10 17:53:37]

Just to make sure I understand this: Calling m_webCharacteristic->setValue()
with the pointer to the data view will make Oilpan increase the ref count for
the Data View. When we resolve that the promise with the pointer to the data
view, Oilpan will once again increase the ref count. If the characteristic
object gets GCed then Oilpan will decrease the ref count but it will keep the
object alive because of the reference we used when resolving the promise. Is all
of this correct?

I' just want to be sure that we won't run into use after delete if the
characteristic object is GCed but someone is still holding on to the pointer
used to resolve the promise.

[sof, 2016/04/10 18:12:51]

DOMDataView is on the Oilpan heap, so there's no ref counting going on for it.
That DOMDataView will only be eligible for GCing once it is no longer reachable,
i.e., when both this characteristic object and the promise have let go (or
themselves have become unreachable from the running renderer process.)

[ortuno, 2016/04/10 18:15:52]

Got it. Thanks! Bluetooth LGTM

     }
 
@@ -215,9 +211,10 @@ ScriptPromise BluetoothRemoteGATTCharacteristic::stopNotifications(ScriptState*
 
 DEFINE_TRACE(BluetoothRemoteGATTCharacteristic)
 {
+    visitor->trace(m_properties);
+    visitor->trace(m_value);
     RefCountedGarbageCollectedEventTargetWithInlineData<BluetoothRemoteGATTCharacteristic>::trace(visitor);
     ActiveDOMObject::trace(visitor);
-    visitor->trace(m_properties);
 }
 
 } // namespace blink