Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/fileapi/Blob.h

Index: third_party/WebKit/Source/core/fileapi/Blob.h
diff --git a/third_party/WebKit/Source/core/fileapi/Blob.h b/third_party/WebKit/Source/core/fileapi/Blob.h
index 92785afcf246f891b7c7d32b10ebd61d25b663e6..4c411c4f695a355bab2f5f031d3d248ce9af3207 100644
--- a/third_party/WebKit/Source/core/fileapi/Blob.h
+++ b/third_party/WebKit/Source/core/fileapi/Blob.h
@@ -41,6 +41,7 @@
 #include "platform/blob/BlobData.h"
 #include "platform/heap/Handle.h"
 #include "wtf/PassRefPtr.h"
+#include "wtf/RefCounted.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
@@ -116,10 +117,10 @@
         for (size_t i = 0; i < parts.size(); ++i) {
             const ItemType& item = parts[i];
             if (item.isArrayBuffer()) {
-                DOMArrayBuffer* arrayBuffer = item.getAsArrayBuffer();
+                RefPtr<DOMArrayBuffer> arrayBuffer = item.getAsArrayBuffer();
                 blobData->appendBytes(arrayBuffer->data(), arrayBuffer->byteLength());
             } else if (item.isArrayBufferView()) {
-                DOMArrayBufferView* arrayBufferView = item.getAsArrayBufferView();
+                RefPtr<DOMArrayBufferView> arrayBufferView = item.getAsArrayBufferView();
                 blobData->appendBytes(arrayBufferView->baseAddress(), arrayBufferView->byteLength());
             } else if (item.isBlob()) {
                 item.getAsBlob()->appendTo(*blobData);