Oilpan: move 2D Canvas and WebGL objects to the heap.

Source/core/html/canvas/WebGLBuffer.cpp

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 13 matching lines @@
  */
 
 #include "config.h"
 
 #include "core/html/canvas/WebGLBuffer.h"
 
 #include "core/html/canvas/WebGLRenderingContextBase.h"
 
 namespace blink {
 
-PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContextBase* ctx)
+PassRefPtrWillBeRawPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContextBase* ctx)
 {
-    return adoptRef(new WebGLBuffer(ctx));
+    return adoptRefWillBeNoop(new WebGLBuffer(ctx));
 }
 
 WebGLBuffer::WebGLBuffer(WebGLRenderingContextBase* ctx)
     : WebGLSharedObject(ctx)
     , m_target(0)
 {
     ScriptWrappable::init(this);
     setObject(ctx->webContext()->createBuffer());
 }
 
 WebGLBuffer::~WebGLBuffer()
 {
-    deleteObject(0);
+    // Delete the buffer's platform object. This object will have been
+    // detached from the WebGLContextGroup if the group object was
+    // finalized first. With Oilpan not enabled, it always will be,
+    // but with Oilpan enabled, the WebGLBuffer might end up being
+    // finalized first. In which case detachment is needed to ensure
+    // that the platform object is indeed deleted.
+    //
+    // To keep the code regular, the trivial detach()ment is always
+    // performed.
+    detachAndDeleteObject();
 }
 
 void WebGLBuffer::deleteObjectImpl(blink::WebGraphicsContext3D* context3d, Platform3DObject object)
 {
       context3d->deleteBuffer(object);
 }
 
 void WebGLBuffer::setTarget(GLenum target)
 {
     // In WebGL, a buffer is bound to one target in its lifetime
     if (m_target)
         return;
     if (target == GL_ARRAY_BUFFER || target == GL_ELEMENT_ARRAY_BUFFER)
         m_target = target;
 }
 
 }