Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/html/ImageData.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 28 matching lines @@
 namespace blink {
 
 ImageData* ImageData::create(const IntSize& size)
 {
     CheckedNumeric<int> dataSize = 4;
     dataSize *= size.width();
     dataSize *= size.height();
     if (!dataSize.IsValid() || dataSize.ValueOrDie() < 0)
         return nullptr;
 
-    DOMUint8ClampedArray* byteArray = DOMUint8ClampedArray::createOrNull(dataSize.ValueOrDie());
+    RefPtr<DOMUint8ClampedArray> byteArray = DOMUint8ClampedArray::createOrNull(dataSize.ValueOrDie());
     if (!byteArray)
         return nullptr;
 
-    return new ImageData(size, byteArray);
+    return new ImageData(size, byteArray.release());
 }
 
-ImageData* ImageData::create(const IntSize& size, DOMUint8ClampedArray* byteArray)
+ImageData* ImageData::create(const IntSize& size, PassRefPtr<DOMUint8ClampedArray> byteArray)
 {
     CheckedNumeric<int> dataSize = 4;
     dataSize *= size.width();
     dataSize *= size.height();
     if (!dataSize.IsValid())
         return nullptr;
 
     if (dataSize.ValueOrDie() < 0
         || static_cast<unsigned>(dataSize.ValueOrDie()) > byteArray->length())
         return nullptr;
@@ skipping 11 matching lines @@
     CheckedNumeric<unsigned> dataSize = 4;
     dataSize *= width;
     dataSize *= height;
     if (!dataSize.IsValid()
         || static_cast<int>(width) < 0
         || static_cast<int>(height) < 0) {
         exceptionState.throwDOMException(IndexSizeError, "The requested image size exceeds the supported range.");
         return nullptr;
     }
 
-    DOMUint8ClampedArray* byteArray = DOMUint8ClampedArray::createOrNull(dataSize.ValueOrDie());
+    RefPtr<DOMUint8ClampedArray> byteArray = DOMUint8ClampedArray::createOrNull(dataSize.ValueOrDie());
     if (!byteArray) {
         exceptionState.throwDOMException(V8GeneralError, "Out of memory at ImageData creation");
         return nullptr;
     }
 
-    return new ImageData(IntSize(width, height), byteArray);
+    return new ImageData(IntSize(width, height), byteArray.release());
 }
 
 bool ImageData::validateConstructorArguments(DOMUint8ClampedArray* data, unsigned width, unsigned& lengthInPixels, ExceptionState& exceptionState)
 {
     if (!width) {
         exceptionState.throwDOMException(IndexSizeError, "The source width is zero or not a number.");
         return false;
     }
     ASSERT(data);
     unsigned length = data->length();
@@ skipping 62 matching lines @@
         // Create a V8 Uint8ClampedArray object and set the "data" property
         // of the ImageData object to the created v8 object, eliminating the
         // C++ callback when accessing the "data" property.
         v8::Local<v8::Value> pixelArray = toV8(m_data.get(), wrapper, isolate);
         if (pixelArray.IsEmpty() || !v8CallBoolean(wrapper->DefineOwnProperty(isolate->GetCurrentContext(), v8AtomicString(isolate, "data"), pixelArray, v8::ReadOnly)))
             return v8::Local<v8::Object>();
     }
     return wrapper;
 }
 
-ImageData::ImageData(const IntSize& size, DOMUint8ClampedArray* byteArray)
+ImageData::ImageData(const IntSize& size, PassRefPtr<DOMUint8ClampedArray> byteArray)
     : m_size(size)
     , m_data(byteArray)
 {
     ASSERT(size.width() >= 0 && size.height() >= 0);
     ASSERT_WITH_SECURITY_IMPLICATION(static_cast<unsigned>(size.width() * size.height() * 4) <= m_data->length());
 }
 
 void ImageData::dispose()
 {
     m_data.clear();
 }
 
 } // namespace blink