Oilpan: move 2D Canvas and WebGL objects to the heap.

Source/core/html/canvas/WebGLBuffer.cpp

Index: Source/core/html/canvas/WebGLBuffer.cpp
diff --git a/Source/core/html/canvas/WebGLBuffer.cpp b/Source/core/html/canvas/WebGLBuffer.cpp
index 6308eccf1922cc6d9b3322e0eec360307e87dc99..0dd42572ca28c15757feed56d48c7ca18aebf195 100644
--- a/Source/core/html/canvas/WebGLBuffer.cpp
+++ b/Source/core/html/canvas/WebGLBuffer.cpp
@@ -31,9 +31,9 @@
 
 namespace WebCore {
 
-PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContextBase* ctx)
+PassRefPtrWillBeRawPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContextBase* ctx)
 {
-    return adoptRef(new WebGLBuffer(ctx));
+    return adoptRefWillBeNoop(new WebGLBuffer(ctx));
 }
 
 WebGLBuffer::WebGLBuffer(WebGLRenderingContextBase* ctx)
@@ -46,7 +46,7 @@ WebGLBuffer::WebGLBuffer(WebGLRenderingContextBase* ctx)
 
 WebGLBuffer::~WebGLBuffer()
 {
-    deleteObject(0);
+    detachAndDeleteObject();

[Ken Russell (switch to Gerrit), 2014/07/19 00:27:15]

It's not obvious why we need to forcibly call detach. I vaguely recall from the
discussion that it's because there's no guarantee about destruction order in
sub-graphs, so the previous unchaining behavior of container (like
WebGLFramebuffer) to pointed-to object (like WebGLRenderbuffer) no longer works.
Please add a comment.

[sof, 2014/07/19 19:55:57]

Yes, it definitely merits a comment; added a longer one that tries to explain.

For this particular one, the WebGLContextGroup isn't guaranteed to be finalized
before all the WebGLSharedObjects it tracks, hence the need.

 }
 
 void WebGLBuffer::deleteObjectImpl(blink::WebGraphicsContext3D* context3d, Platform3DObject object)