Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 119 matching lines @@
 
     for (size_t i = 0; i < arrayBuffers.size(); i++) {
         if (arrayBuffers[i]->isNeutered()) {
             exceptionState.throwDOMException(DataCloneError, "ArrayBuffer at index " + String::number(i) + " is already neutered.");
             return nullptr;
         }
     }
 
     OwnPtr<ArrayBufferContentsArray> contents = adoptPtr(new ArrayBufferContentsArray(arrayBuffers.size()));
 
-    HeapHashSet<Member<DOMArrayBufferBase>> visited;
+    HashSet<DOMArrayBufferBase*> visited;
     for (size_t i = 0; i < arrayBuffers.size(); i++) {
         if (visited.contains(arrayBuffers[i].get()))
             continue;
         visited.add(arrayBuffers[i].get());
 
         if (arrayBuffers[i]->isShared()) {
             bool result = arrayBuffers[i]->shareContentsWith(contents->at(i));
             if (!result) {
                 exceptionState.throwDOMException(DataCloneError, "SharedArrayBuffer at index " + String::number(i) + " could not be transferred.");
                 return nullptr;
             }
         } else {
             Vector<v8::Local<v8::ArrayBuffer>, 4> bufferHandles;
             v8::HandleScope handleScope(isolate);
-            acculumateArrayBuffersForAllWorlds(isolate, static_cast<DOMArrayBuffer*>(arrayBuffers[i].get()), bufferHandles);
+            acculumateArrayBuffersForAllWorlds(isolate, static_pointer_cast<DOMArrayBuffer>(arrayBuffers[i]).get(), bufferHandles);
             bool isNeuterable = true;
             for (size_t j = 0; j < bufferHandles.size(); j++)
                 isNeuterable &= bufferHandles[j]->IsNeuterable();
 
-            DOMArrayBufferBase* toTransfer = arrayBuffers[i];
+            RefPtr<DOMArrayBufferBase> toTransfer = arrayBuffers[i];
             if (!isNeuterable)
                 toTransfer = DOMArrayBuffer::create(arrayBuffers[i]->buffer());
             bool result = toTransfer->transfer(contents->at(i));
             if (!result) {
                 exceptionState.throwDOMException(DataCloneError, "ArrayBuffer at index " + String::number(i) + " could not be transferred.");
                 return nullptr;
             }
 
             if (isNeuterable)
                 for (size_t j = 0; j < bufferHandles.size(); j++)
@@ skipping 55 matching lines @@
         // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
         if (V8MessagePort::hasInstance(transferrable, isolate)) {
             MessagePort* port = V8MessagePort::toImpl(v8::Local<v8::Object>::Cast(transferrable));
             // Check for duplicate MessagePorts.
             if (ports.contains(port)) {
                 exceptionState.throwDOMException(DataCloneError, "Message port at index " + String::number(i) + " is a duplicate of an earlier port.");
                 return false;
             }
             ports.append(port);
         } else if (V8ArrayBuffer::hasInstance(transferrable, isolate)) {
-            DOMArrayBuffer* arrayBuffer = V8ArrayBuffer::toImpl(v8::Local<v8::Object>::Cast(transferrable));
+            RefPtr<DOMArrayBuffer> arrayBuffer = V8ArrayBuffer::toImpl(v8::Local<v8::Object>::Cast(transferrable));
             if (arrayBuffers.contains(arrayBuffer)) {
                 exceptionState.throwDOMException(DataCloneError, "ArrayBuffer at index " + String::number(i) + " is a duplicate of an earlier ArrayBuffer.");
                 return false;
             }
-            arrayBuffers.append(arrayBuffer);
+            arrayBuffers.append(arrayBuffer.release());
         } else if (V8SharedArrayBuffer::hasInstance(transferrable, isolate)) {
-            DOMSharedArrayBuffer* sharedArrayBuffer = V8SharedArrayBuffer::toImpl(v8::Local<v8::Object>::Cast(transferrable));
+            RefPtr<DOMSharedArrayBuffer> sharedArrayBuffer = V8SharedArrayBuffer::toImpl(v8::Local<v8::Object>::Cast(transferrable));
             if (arrayBuffers.contains(sharedArrayBuffer)) {
                 exceptionState.throwDOMException(DataCloneError, "SharedArrayBuffer at index " + String::number(i) + " is a duplicate of an earlier SharedArrayBuffer.");
                 return false;
             }
-            arrayBuffers.append(sharedArrayBuffer);
+            arrayBuffers.append(sharedArrayBuffer.release());
         } else if (V8ImageBitmap::hasInstance(transferrable, isolate)) {
-            ImageBitmap* imageBitmap = V8ImageBitmap::toImpl(v8::Local<v8::Object>::Cast(transferrable));
+            RawPtr<ImageBitmap> imageBitmap = V8ImageBitmap::toImpl(v8::Local<v8::Object>::Cast(transferrable));
             if (imageBitmaps.contains(imageBitmap)) {
                 exceptionState.throwDOMException(DataCloneError, "ImageBitmap at index " + String::number(i) + " is a duplicate of an earlier ImageBitmap.");
                 return false;
             }
-            imageBitmaps.append(imageBitmap);
+            imageBitmaps.append(imageBitmap.release());
         } else {
             exceptionState.throwTypeError("Value at index " + String::number(i) + " does not have a transferable type.");
             return false;
         }
     }
     return true;
 }
 
 void SerializedScriptValue::registerMemoryAllocatedWithCurrentScriptContext()
 {
@@ skipping 23 matching lines @@
 {
     m_arrayBufferContentsArray = createArrayBuffers(isolate, arrayBuffers, exceptionState);
 }
 
 void SerializedScriptValue::transferImageBitmaps(v8::Isolate* isolate, ImageBitmapArray& imageBitmaps, ExceptionState& exceptionState)
 {
     m_imageBitmapContentsArray = createImageBitmaps(isolate, imageBitmaps, exceptionState);
 }
 
 } // namespace blink