Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/dom/DOMTypedArray.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/DOMTypedArray.h"
 
 #include "bindings/core/v8/DOMDataStore.h"
 #include "bindings/core/v8/V8ArrayBuffer.h"
 #include "bindings/core/v8/V8Float32Array.h"
 #include "bindings/core/v8/V8Float64Array.h"
 #include "bindings/core/v8/V8Int16Array.h"
 #include "bindings/core/v8/V8Int32Array.h"
 #include "bindings/core/v8/V8Int8Array.h"
 #include "bindings/core/v8/V8Uint16Array.h"
 #include "bindings/core/v8/V8Uint32Array.h"
 #include "bindings/core/v8/V8Uint8Array.h"
 #include "bindings/core/v8/V8Uint8ClampedArray.h"
 
 namespace blink {
 
 template<typename WTFTypedArray, typename V8TypedArray>
 v8::Local<v8::Object> DOMTypedArray<WTFTypedArray, V8TypedArray>::wrap(v8::Isolate* isolate, v8::Local<v8::Object> creationContext)
 {
+    // It's possible that no one except for the new wrapper owns this object at
+    // this moment, so we have to prevent GC to collect this object until the
+    // object gets associated with the wrapper.
+    RefPtr<ThisType> protect(this);
+
     DCHECK(!DOMDataStore::containsWrapper(this, isolate));
 
     const WrapperTypeInfo* wrapperTypeInfo = this->wrapperTypeInfo();
-    DOMArrayBufferBase* buffer = this->bufferBase();
-    v8::Local<v8::Value> v8Buffer = toV8(buffer, creationContext, isolate);
+    RefPtr<DOMArrayBufferBase> buffer = this->bufferBase();
+    v8::Local<v8::Value> v8Buffer = toV8(buffer.get(), creationContext, isolate);
     if (v8Buffer.IsEmpty())
         return v8::Local<v8::Object>();
     DCHECK_EQ(isShared(), v8Buffer->IsSharedArrayBuffer());
 
     v8::Local<v8::Object> wrapper;
     if (isShared()) {
         wrapper = V8TypedArray::New(v8Buffer.As<v8::SharedArrayBuffer>(), byteOffset(), length());
     } else {
         wrapper = V8TypedArray::New(v8Buffer.As<v8::ArrayBuffer>(), byteOffset(), length());
     }
@@ skipping 31 matching lines @@
 template class CORE_TEMPLATE_EXPORT DOMTypedArray<WTF::Int16Array, v8::Int16Array>;
 template class CORE_TEMPLATE_EXPORT DOMTypedArray<WTF::Int32Array, v8::Int32Array>;
 template class CORE_TEMPLATE_EXPORT DOMTypedArray<WTF::Uint8Array, v8::Uint8Array>;
 template class CORE_TEMPLATE_EXPORT DOMTypedArray<WTF::Uint8ClampedArray, v8::Uint8ClampedArray>;
 template class CORE_TEMPLATE_EXPORT DOMTypedArray<WTF::Uint16Array, v8::Uint16Array>;
 template class CORE_TEMPLATE_EXPORT DOMTypedArray<WTF::Uint32Array, v8::Uint32Array>;
 template class CORE_TEMPLATE_EXPORT DOMTypedArray<WTF::Float32Array, v8::Float32Array>;
 template class CORE_TEMPLATE_EXPORT DOMTypedArray<WTF::Float64Array, v8::Float64Array>;
 
 } // namespace blink