Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/layout/shapes/Shape.cpp

 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 190 matching lines @@
         // that loads SVG Images during paint invalidations to mark layoutObjects for
         // layout, which is not allowed. See https://crbug.com/429346
         ImageObserverDisabler disabler(image);
         SkPaint paint;
         IntRect imageSourceRect(IntPoint(), image->size());
         IntRect imageDestRect(IntPoint(), imageRect.size());
         image->draw(imageBuffer->canvas(), paint, imageDestRect, imageSourceRect, DoNotRespectImageOrientation, Image::DoNotClampImageToSourceRect);
 
         WTF::ArrayBufferContents contents;
         imageBuffer->getImageData(Unmultiplied, IntRect(IntPoint(), imageRect.size()), contents);
-        DOMArrayBuffer* arrayBuffer = DOMArrayBuffer::create(contents);
-        DOMUint8ClampedArray* pixelArray = DOMUint8ClampedArray::create(arrayBuffer, 0, arrayBuffer->byteLength());
+        RefPtr<DOMArrayBuffer> arrayBuffer = DOMArrayBuffer::create(contents);
+        RefPtr<DOMUint8ClampedArray> pixelArray = DOMUint8ClampedArray::create(arrayBuffer, 0, arrayBuffer->byteLength());
         unsigned pixelArrayOffset = 3; // Each pixel is four bytes: RGBA.
         uint8_t alphaPixelThreshold = threshold * 255;
 
         ASSERT(static_cast<unsigned>(imageRect.width() * imageRect.height() * 4) == pixelArray->length());
 
         int minBufferY = std::max(0, marginRect.y() - imageRect.y());
         int maxBufferY = std::min(imageRect.height(), marginRect.maxY() - imageRect.y());
 
         for (int y = minBufferY; y < maxBufferY; ++y) {
             int startX = -1;
@@ skipping 22 matching lines @@
     FloatRect rect(0, 0, roundedRect.rect().width(), roundedRect.rect().height());
     FloatRoundedRect bounds(rect, roundedRect.getRadii());
     OwnPtr<Shape> shape = createInsetShape(bounds);
     shape->m_writingMode = writingMode;
     shape->m_margin = margin;
 
     return shape.release();
 }
 
 } // namespace blink