Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/dom/DOMSharedArrayBuffer.cpp

Index: third_party/WebKit/Source/core/dom/DOMSharedArrayBuffer.cpp
diff --git a/third_party/WebKit/Source/core/dom/DOMSharedArrayBuffer.cpp b/third_party/WebKit/Source/core/dom/DOMSharedArrayBuffer.cpp
index 91167426ddcee50e5198ee93d4960e0d66c4ba56..a60258c4b01ecb9baa47290b11e979d90a1b1666 100644
--- a/third_party/WebKit/Source/core/dom/DOMSharedArrayBuffer.cpp
+++ b/third_party/WebKit/Source/core/dom/DOMSharedArrayBuffer.cpp
@@ -10,6 +10,11 @@
 
 v8::Local<v8::Object> DOMSharedArrayBuffer::wrap(v8::Isolate* isolate, v8::Local<v8::Object> creationContext)
 {
+    // It's possible that no one except for the new wrapper owns this object at
+    // this moment, so we have to prevent GC to collect this object until the
+    // object gets associated with the wrapper.
+    RefPtr<DOMSharedArrayBuffer> protect(this);
+
     DCHECK(!DOMDataStore::containsWrapper(this, isolate));
 
     const WrapperTypeInfo* wrapperTypeInfo = this->wrapperTypeInfo();