Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
index f2a50965cb56c90e9053189173815547399d28ba..03aed594ebe1ccbb56e744bf9fdb46ce227b05d7 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
@@ -646,12 +646,16 @@
     ImageData* imageData = toImageData(BackBuffer, SnapshotReasonToBlob);
     // imageData unref its data, which we still keep alive for the async toBlob thread
     ScopedDisposal<ImageData> disposer(imageData);
-    CanvasAsyncBlobCreator* asyncCreator = CanvasAsyncBlobCreator::create(imageData->data(), encodingMimeType, imageData->size(), callback);
-
-    if (encodingMimeType == DefaultMimeType)
-        asyncCreator->scheduleAsyncBlobCreation(true);
-    else
-        asyncCreator->scheduleAsyncBlobCreation(false, quality);
+    // Add a ref to keep image data alive until completion of encoding
+    RefPtr<DOMUint8ClampedArray> imageDataRef(imageData->data());
+
+    RefPtr<CanvasAsyncBlobCreator> asyncCreatorRef = CanvasAsyncBlobCreator::create(imageDataRef.release(), encodingMimeType, imageData->size(), callback);
+
+    if (encodingMimeType == DefaultMimeType) {
+        asyncCreatorRef->scheduleAsyncBlobCreation(true);
+    } else {
+        asyncCreatorRef->scheduleAsyncBlobCreation(false, quality);
+    }
 }
 
 void HTMLCanvasElement::addListener(CanvasDrawListener* listener)