Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/dom/DOMDataView.cpp

Index: third_party/WebKit/Source/core/dom/DOMDataView.cpp
diff --git a/third_party/WebKit/Source/core/dom/DOMDataView.cpp b/third_party/WebKit/Source/core/dom/DOMDataView.cpp
index b76e0a4b3b020de67612dea5df6a313ba3ff571f..d95163d4cc25f01a63b355a3f5703f48e5b570d8 100644
--- a/third_party/WebKit/Source/core/dom/DOMDataView.cpp
+++ b/third_party/WebKit/Source/core/dom/DOMDataView.cpp
@@ -15,7 +15,7 @@
 
 class DataView final : public ArrayBufferView {
 public:
-    static PassRefPtr<DataView> create(ArrayBuffer* buffer, unsigned byteOffset, unsigned byteLength)
+    static PassRefPtr<DataView> create(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned byteLength)
     {
         RELEASE_ASSERT(byteOffset <= buffer->byteLength());
         CheckedInt<uint32_t> checkedOffset(byteOffset);
@@ -37,7 +37,7 @@
     }
 
 private:
-    DataView(ArrayBuffer* buffer, unsigned byteOffset, unsigned byteLength)
+    DataView(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned byteLength)
         : ArrayBufferView(buffer, byteOffset)
         , m_byteLength(byteLength) { }
 
@@ -46,14 +46,20 @@
 
 } // anonymous namespace
 
-DOMDataView* DOMDataView::create(DOMArrayBufferBase* buffer, unsigned byteOffset, unsigned byteLength)
+PassRefPtr<DOMDataView> DOMDataView::create(PassRefPtr<DOMArrayBufferBase> prpBuffer, unsigned byteOffset, unsigned byteLength)
 {
+    RefPtr<DOMArrayBufferBase> buffer = prpBuffer;
     RefPtr<DataView> dataView = DataView::create(buffer->buffer(), byteOffset, byteLength);
-    return new DOMDataView(dataView, buffer);
+    return adoptRef(new DOMDataView(dataView.release(), buffer.release()));
 }
 
 v8::Local<v8::Object> DOMDataView::wrap(v8::Isolate* isolate, v8::Local<v8::Object> creationContext)
 {
+    // It's possible that no one except for the new wrapper owns this object at
+    // this moment, so we have to prevent GC to collect this object until the
+    // object gets associated with the wrapper.
+    RefPtr<DOMDataView> protect(this);
+
     DCHECK(!DOMDataStore::containsWrapper(this, isolate));
 
     const WrapperTypeInfo* wrapperTypeInfo = this->wrapperTypeInfo();