StyleTree should have only scoped style resolvers for in-document nodes.

StyleResolver::resetAuthorStyles misses removing scoped style resolvers
when a given scoping node's hasScopedHTMLStyleChild flag has been already cleared, or
a given scoping node is in a shadow tree but not shadow root.

In the above cases, StyleTree has scoped style resolvers whose scoping nodes are not in document.
This causes heap-use-after-free.

To test this issue, added ASSERTION to setupScopedStylesTree, and made the following 3 existing layout tests
(need debug-built content_shell) cover this issue. Without this patch, the layout tests crash
in WebCore::ScopedStyleTree::setupScopedStylesTree().

BUG=313529

TEST=fast/dom/shadow/athost-atrules.html,fast/dom/shadow/host-pseudo-class.html,fast/css/style-scoped/style-scoped-change-scoped-in-shadow.html

Review URL: https://codereview.chromium.org/54633002

git-svn-id: svn://svn.chromium.org/blink/trunk@161142 bbb929c8-8fbe-4397-9dbb-9b2b20218538