Block "]]>" in createCDataSection

It's not possible to serialize a CData section with ]]> in it
so disallow that already in xmldoc.createCDataSection.

This is compatible with MSIE and Gecko.

BUG=268762

Review URL: https://chromiumcodereview.appspot.com/22911020

git-svn-id: svn://svn.chromium.org/blink/trunk@156640 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix touch handler ASSERT when an iframe containing a plugin changes source

When an iframe's src is changed, Document::removeAllEventListeners is used to clear all event listeners in the document, as a result the parent document will clear out any known touch handler for the iframe.  But if the iframe contained a plugin, then when that plugin is destroyed it'll try to notify the document that it is no longer handling touch events, and (if it's the only touch event handler on the document) the parent document will get a duplicate
removal notification.

Also, despite Document::removeAllEventListeners telling it's parent document it has no more handlers, it now actually clears it's own list too.

This is a reland of https://chromiumcodereview.appspot.com/22301016 after fixing the html parser perf regression described in BUG 273219.  The regression was due to HTMLPluginElement::renderWidgetForJSBindings triggering layout (and the test was explicitly avoiding layout by setting display: none - it's a very long document).  To address that I've added the "existingRenderWidget" method to obtain any existing RenderWidget without triggering layout, and reimplemented renderWidgetForJSBindings on top of that.  If the Widget doesn't exist yet, then we don't need to tell it to reset it's state.

BUG=254203
TBR=tony@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23093019

git-svn-id: svn://svn.chromium.org/blink/trunk@156641 bbb929c8-8fbe-4397-9dbb-9b2b20218538