Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

 /*
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 628 matching lines @@
         if (v8Value->IsNumber()) {
             quality = v8Value.As<v8::Number>()->Value();
         }
     }
 
     String encodingMimeType = toEncodingMimeType(mimeType, EncodeReasonToBlobCallback);
 
     ImageData* imageData = toImageData(BackBuffer, SnapshotReasonToBlob);
     // imageData unref its data, which we still keep alive for the async toBlob thread
     ScopedDisposal<ImageData> disposer(imageData);
-    CanvasAsyncBlobCreator* asyncCreator = CanvasAsyncBlobCreator::create(imageData->data(), encodingMimeType, imageData->size(), callback);
+    // Add a ref to keep image data alive until completion of encoding
+    RefPtr<DOMUint8ClampedArray> imageDataRef(imageData->data());
 
-    if (encodingMimeType == DefaultMimeType)
-        asyncCreator->scheduleAsyncBlobCreation(true);
-    else
-        asyncCreator->scheduleAsyncBlobCreation(false, quality);
+    RefPtr<CanvasAsyncBlobCreator> asyncCreatorRef = CanvasAsyncBlobCreator::create(imageDataRef.release(), encodingMimeType, imageData->size(), callback);
+
+    if (encodingMimeType == DefaultMimeType) {
+        asyncCreatorRef->scheduleAsyncBlobCreation(true);
+    } else {
+        asyncCreatorRef->scheduleAsyncBlobCreation(false, quality);
+    }
 }
 
 void HTMLCanvasElement::addListener(CanvasDrawListener* listener)
 {
     m_listeners.add(listener);
 }
 
 void HTMLCanvasElement::removeListener(CanvasDrawListener* listener)
 {
     m_listeners.remove(listener);
@@ skipping 451 matching lines @@
 }
 
 std::pair<Element*, String> HTMLCanvasElement::getControlAndIdIfHitRegionExists(const LayoutPoint& location)
 {
     if (m_context && m_context->is2d())
         return m_context->getControlAndIdIfHitRegionExists(location);
     return std::make_pair(nullptr, String());
 }
 
 } // namespace blink