Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/dom/DOMArrayPiece.cpp

Index: third_party/WebKit/Source/core/dom/DOMArrayPiece.cpp
diff --git a/third_party/WebKit/Source/core/dom/DOMArrayPiece.cpp b/third_party/WebKit/Source/core/dom/DOMArrayPiece.cpp
index 51dafc03f370ad7c486270e2f5f98bdb35b86c21..bdf69e975a0f559d9389f4ecc82b9f26aa71e995 100644
--- a/third_party/WebKit/Source/core/dom/DOMArrayPiece.cpp
+++ b/third_party/WebKit/Source/core/dom/DOMArrayPiece.cpp
@@ -11,10 +11,11 @@
 DOMArrayPiece::DOMArrayPiece(const ArrayBufferOrArrayBufferView& arrayBufferOrView, InitWithUnionOption option)
 {
     if (arrayBufferOrView.isArrayBuffer()) {
-        DOMArrayBuffer* arrayBuffer = arrayBufferOrView.getAsArrayBuffer();
+        RefPtr<DOMArrayBuffer> arrayBuffer = arrayBufferOrView.getAsArrayBuffer();
         initWithData(arrayBuffer->data(), arrayBuffer->byteLength());
     } else if (arrayBufferOrView.isArrayBufferView()) {
-        DOMArrayBufferView* arrayBufferView = arrayBufferOrView.getAsArrayBufferView();
+        RefPtr<DOMArrayBufferView> arrayBufferView =
+            arrayBufferOrView.getAsArrayBufferView();
         initWithData(arrayBufferView->baseAddress(), arrayBufferView->byteLength());
     } else if (arrayBufferOrView.isNull() && option == AllowNullPointToNullWithZeroSize) {
         initWithData(nullptr, 0);