Revert of Move DOMArrayBuffer, DOMArrayBufferViews and DataView to the heap.

third_party/WebKit/Source/core/dom/DOMTypedArray.cpp

Index: third_party/WebKit/Source/core/dom/DOMTypedArray.cpp
diff --git a/third_party/WebKit/Source/core/dom/DOMTypedArray.cpp b/third_party/WebKit/Source/core/dom/DOMTypedArray.cpp
index edc6f268415293d054f0d002c4b0d29dbded2e90..109808a9eaf32496d1ed73f18c65593dc0f9c163 100644
--- a/third_party/WebKit/Source/core/dom/DOMTypedArray.cpp
+++ b/third_party/WebKit/Source/core/dom/DOMTypedArray.cpp
@@ -21,11 +21,16 @@
 template<typename WTFTypedArray, typename V8TypedArray>
 v8::Local<v8::Object> DOMTypedArray<WTFTypedArray, V8TypedArray>::wrap(v8::Isolate* isolate, v8::Local<v8::Object> creationContext)
 {
+    // It's possible that no one except for the new wrapper owns this object at
+    // this moment, so we have to prevent GC to collect this object until the
+    // object gets associated with the wrapper.
+    RefPtr<ThisType> protect(this);
+
     DCHECK(!DOMDataStore::containsWrapper(this, isolate));
 
     const WrapperTypeInfo* wrapperTypeInfo = this->wrapperTypeInfo();
-    DOMArrayBufferBase* buffer = this->bufferBase();
-    v8::Local<v8::Value> v8Buffer = toV8(buffer, creationContext, isolate);
+    RefPtr<DOMArrayBufferBase> buffer = this->bufferBase();
+    v8::Local<v8::Value> v8Buffer = toV8(buffer.get(), creationContext, isolate);
     if (v8Buffer.IsEmpty())
         return v8::Local<v8::Object>();
     DCHECK_EQ(isShared(), v8Buffer->IsSharedArrayBuffer());