Move RenderLayerStackingNode out of RenderLayer.

This CL extracts the code related to stacking out of render layer and
into a separate class.

BUG=302120

Review URL: https://codereview.chromium.org/25968003

git-svn-id: svn://svn.chromium.org/blink/trunk@159283 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Assertions for TreeShared::m_deletionHasBegun should be ASSERT_WITH_SECURITY_IMPLICATION.

They are typical signals for use-after-free.

The main changes are conversions from ASSERT(!m_deletionHasBegun) to
ASSERT_WITH_SECURITY_IMPLICATION(!m_deletionHasBegun).

Declaration of m_deletionHasBegun and code to update m_deletionHasBegun should
be enabled only if ADDRESS_SANITIZER is defined or assertions are enabled. This
CL introduces SECURITY_ASSERT_ENABLED to represent this condition.

Some assertion-related code were wrongly wrapped with !NDEBUG. It should be
!ASSERT_DISABLED.

BUG=none
TEST=none; no behavior changes

Review URL: https://codereview.chromium.org/26689006

git-svn-id: svn://svn.chromium.org/blink/trunk@159284 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[CSS Shapes] Use unsigned for the internal representation of shape-margin for image valued shapes

RasterShape now converts shape-margin to an unsigned internally. Additionally, it now uses ceil() to convert the floating point (Length) CSS property to its internal value, for the sake of consistency with the WebKit version. I expect that the Shapes spec will eventually make this detail a requirement (http://dev.w3.org/csswg/css-shapes-1/#shape-margin-property).

No new tests were included since this is just an internal clean-up.


BUG=304256

Review URL: https://codereview.chromium.org/26282004

git-svn-id: svn://svn.chromium.org/blink/trunk@159285 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove RenderLayer::enclosingScrollableArea

To avoid code duplication between RenderLayer and
RenderLayerScrollableArea, refactored the common
code into RenderObject::enclosingScrollableBox.

BUG=260899

Review URL: https://codereview.chromium.org/26654004

git-svn-id: svn://svn.chromium.org/blink/trunk@159287 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Reduce stack size in chunked-big-script.html and re-enable.

BUG=305759
R=ojan@chromium.org

Review URL: https://codereview.chromium.org/26759002

git-svn-id: svn://svn.chromium.org/blink/trunk@159288 bbb929c8-8fbe-4397-9dbb-9b2b20218538